Patchman accepts contributions that improve authorized defensive review quality.
Good contributions:
- better findings heuristics
- tighter framework-specific checklists
- safer remediation examples
- more realistic evaluation fixtures
- packaging and installability improvements
- false positive reductions
Out of scope:
- exploit payload packs
- persistence or evasion guidance
- credential theft workflows
- destructive automation
- unauthorized targeting instructions
- Open an issue describing the gap, the target framework, and the expected review behavior.
- Add or update the relevant skill, command, doc, rule, or eval fixture.
- Update the mirrored plugin-level skill if you change a top-level skill.
- Run the local smoke tests in
tests/. - Include before/after evidence for any heuristic change.
- Findings must be evidence-based.
- Recommendations must be actionable.
- Severity must be justified by impact and reach.
- Confidence must reflect missing context honestly.
- Examples must stay defensive and non-weaponized.
- Authorized defensive scope preserved
- README or docs updated when behavior changes
- Eval fixture added or updated
- Mirrored plugin skill updated if needed
- No offensive or destructive guidance introduced