TwigaGuide · DevelopersTwigaGuide · DevelopersContributing
How the community expects people to behave, and how to report a vulnerability without publishing it.
Twiga adopts the Contributor Covenant, version 2.0. Contributing means agreeing to it. In short: be welcoming, accept criticism gracefully, and assume good faith.
It applies in the repository, on Discord, and anywhere someone is representing the project in public.
Email dev@ai.or.tz. Reports are handled privately and the maintainers are obliged to protect the identity of whoever reports.
Enforcement escalates through four steps depending on severity and repetition: a private correction, a warning, a temporary ban, then a permanent one.
Do not open a public issue
Security problems go by email, not through the issue tracker. EmailVictormag24@gmail.com with the details.Include three things:
| Field | What to write |
|---|---|
| Project | The repository URL. |
| Public | Whether this has been discussed publicly anywhere, and if so where. |
| Description | Precise detail. What the flaw is, how to reproduce it, what it lets an attacker do. |
There is no supported versions policy and no private advisory route configured on GitHub, so email is the only channel.
Secret scanning runs in CI, but only on branches in the main repository, not on pull requests from forks. Do not rely on it to catch a mistake.
.env is ignored by git. Keep it that way and never commit a filled-in copy.