From 38c2b8a59f2ab31a0d994871663b789d67ae09cb Mon Sep 17 00:00:00 2001 From: DanGould Date: Tue, 7 Jul 2026 17:15:28 +0800 Subject: [PATCH 1/3] Add SECURITY.md pointing to security@payjoin.org GitHub surfaces this file in the Security tab and in the report-a- vulnerability flow, so private disclosure has a discoverable path instead of landing in the public issue tracker. --- .github/SECURITY.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .github/SECURITY.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 000000000..d23117a2d --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,8 @@ +# Security Policy + +To report a vulnerability, email +[security@payjoin.org](mailto:security@payjoin.org). Do not open a public +issue or pull request for anything security-sensitive. + +We follow coordinated disclosure: we will work with you on a fix and agree +on a disclosure timeline before details are published. From cd33305f846faa162a254ee7804ac15e18c55266 Mon Sep 17 00:00:00 2001 From: DanGould Date: Tue, 7 Jul 2026 17:57:27 +0800 Subject: [PATCH 2/3] Add CODEOWNERS listing repository maintainers GitHub requests review from listed owners on every PR, and the file makes the maintainer set public and machine-readable. Enforcement via the require-review-from-code-owners branch protection setting is a separate decision. --- .github/CODEOWNERS | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000..336eb16ba --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# Maintainers. Last matching pattern takes precedence. +* @benalleng @DanGould @spacebear21 From dc28d76734ba86ddb9214c4e08ef2e1eca320c65 Mon Sep 17 00:00:00 2001 From: DanGould Date: Tue, 7 Jul 2026 17:57:27 +0800 Subject: [PATCH 3/3] Document scope, review, and licensing norms Write down the norms a contributor needs while working in this repository. --- .github/CONTRIBUTING.md | 46 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 88a92c914..77afd0964 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -16,12 +16,31 @@ Most discussion about Payjoin research and development happens on [Discord](http --- +## Scope + +Issues and pull requests are for technical substance. Foundation +governance, personnel, and licensing or IP matters are out of scope. Take +them to [Foundation leadership](https://payjoin.org/blog/2025/08/08/announcing-payjoin-foundation/) +directly at [admin@payjoin.org](mailto:admin@payjoin.org). Maintainers may lock or hide +off-topic threads by pointing to this section, and may temporarily block +accounts for sustained off-topic participation, with notice. + +--- + ## Issues Using and testing Payjoin Dev Kit is an effective way for new contributors to both learn and provide value. If you find a bug, incorrect or unclear documentation, or have any other problem, consider [creating an issue](https://github.com/payjoin/rust-payjoin/issues). Before doing so, please search through [existing issues](https://github.com/payjoin/rust-payjoin/issues) to see if your problem has already been addressed or is actively being discussed. If you can, provide a fully reproducible example or the steps we can use to reproduce the issue to speed up the debugging process. --- +## Security + +Do not open public issues or pull requests for vulnerabilities. Report them +privately to [security@payjoin.org](mailto:security@payjoin.org) as described +in [SECURITY.md](SECURITY.md). + +--- + ## Documentation Good documentation is essential to understanding what PDK does and how to use it. Since PDK seeks to raise Payjoin adoption by making it easy for developers to integrate it into their wallets, providing clear and complete documentation is critical. Good documentation is also invaluable to new contributors ramping up quickly. If _you_ find something hard to understand or difficult to figure out how to use from the documentation, it's a sign they could be improved. To contribute to the documentation please [fork the repository](https://github.com/payjoin/rust-payjoin/fork), make changes there, and then submit a pull request. @@ -152,3 +171,30 @@ nix fmt ### Linting We use [`clippy`](https://github.com/rust-lang/rust-clippy) for linting. Please run `contrib/lint.sh` using the nightly toolchain before submitting any changes. + +--- + +## Review and Merging + +Pull requests are reviewed on technical merit by the repository +maintainers listed in [CODEOWNERS](CODEOWNERS). Protocol wire behavior +follows the BIP process +([BIP 78](https://github.com/bitcoin/bips/blob/master/bip-0078.mediawiki), +[BIP 77](https://github.com/bitcoin/bips/blob/master/bip-0077.md)). +Observable behavior not yet pinned down by a BIP may merge, but is not +considered production ready until it is publicly specified. When +maintainers proceed over a significant technical objection, the rationale +is written up publicly. + +--- + +## Licensing + +Crates in this workspace are licensed as declared in each crate's +`Cargo.toml`: `MITNFA` for most crates, dual MIT/Apache-2.0 for +`payjoin-ffi`. Relicensing the workspace to dual MIT/Apache-2.0 is in +progress in [#1540](https://github.com/payjoin/rust-payjoin/issues/1540). +Unless you explicitly state otherwise, any contribution intentionally +submitted for inclusion in the work by you, as defined in the Apache-2.0 +license, shall be licensed under the license of the crate it modifies and +dual MIT/Apache-2.0, without any additional terms or conditions.