Good first issues — start here (contributor onboarding)

[alphacrack]

Summary

Tracking issue / umbrella for first-time contributors. New here? Start with one of the good first issue items below — comment on it to claim it, then open a PR.

How to get started

1. Read CONTRIBUTING.md (setup, DCO sign-off with git commit -s, PRs target main).
2. pip install -e ".[dev]" then pre-commit install.
3. Run the fast suite: pytest tests/ -m "not e2e".
4. Pick a good first issue, comment to claim it, and open a PR.

Good first issues

Docs & config (no code):

• Fix project URLs in pyproject.toml (bishwasjha → alphacrack) #46 — Fix project URLs in pyproject.toml (bishwasjha → alphacrack)
• Update SECURITY.md supported-versions table for 0.5.x #47 — Update SECURITY.md supported-versions table for 0.5.x
• Add .editorconfig for consistent editor settings #48 — Add .editorconfig
• Verify + add README badges now that 0.5.0 is on PyPI #49 — Verify + add README badges
• Docs: end-to-end MCP server setup walkthrough (Claude Desktop / Cursor / Continue) #50 — MCP server setup walkthrough (Claude Desktop / Cursor / Continue)
• Audit IAC_* env-var docs for completeness #54 — Audit IAC_* env-var docs for completeness
• Add a Troubleshooting section to CONTRIBUTING.md #55 — Add a Troubleshooting section to CONTRIBUTING.md

Small, scoped code:

• Add a clean (zero-findings) Terraform + CDK sample #51 — Add a clean (zero-findings) Terraform + CDK sample
• Add example invocations to CLI --help epilog #52 — Add example invocations to CLI --help epilog
• Export a JSON Schema for scan-report.json #53 — Export a JSON Schema for scan-report.json
• Add a --quiet flag to the CLI for clean CI logs #56 — Add a --quiet flag for clean CI logs
• Extend secret-redaction patterns (GitHub PAT, Slack, Google API keys) #57 — Extend secret-redaction patterns (GitHub PAT, Slack, Google API keys)
• Flip coverage to a hard --cov-fail-under=80 gate #58 — Flip coverage to a hard --cov-fail-under=80 gate
• Add unit tests for the cost-budget preflight path #59 — Add unit tests for the cost-budget preflight path

Want something bigger?

Once you've landed one of the above, help wanted issues (#60–#66) are the next step up — new IaC types (Pulumi #63, CloudFormation #64), a new LLM provider (#65), the --apply flow (#62), and hybrid post-fix re-verification (#61).

Ground rules

• One PR per issue; keep them small and focused.
• Ask questions right on the issue — no question is too basic.
• CI must be green and you must sign off commits (DCO: git commit -s).