# Contributing to Peach

Thank you for your interest in contributing. Peach is built and maintained by Asha Software.

## Before Contributing

- Open an issue before starting significant work — this avoids duplicated effort
- Read the security documentation in `security/` to understand the threat model
- Peach takes cryptographic correctness seriously — changes to `src/crypto/` require careful review

## Development Setup

```bash
bun install --frozen-lockfile
bun run dev          # Chrome dev build with hot reload
bun run test         # run the test suite
bun run typecheck    # tsc --noEmit
```

## What We Welcome

- Bug fixes with tests
- Security findings (see security reporting in `security/README.md`)
- Compatibility improvements for specific browsers or sites
- Documentation improvements
- Translations (contact us first)

## What We're Cautious About

- Changes to cryptographic code — these require extra scrutiny and discussion
- New dependencies — we keep dependencies minimal and exact-pinned for security reasons
- Breaking changes to the vault format — these require migration paths
- UI changes — Peach has a specific design language, large visual changes need discussion first

## Code Style

- TypeScript strict mode throughout
- Tests required for new functionality
- `tsc --noEmit` and the full test suite must pass

## Security Issues

Please do not open public issues for security vulnerabilities. Email hello@peachpasswords.com instead.

## License

By contributing you agree that your contributions will be licensed under GPL v3.