# Contributing

Keep DockDeck changes portable, least-privileged and free from operator-specific infrastructure.

- Branch from the protected default branch.
- Use synthetic container inventories, hostnames and launch URLs in tests and documentation.
- Do not commit `.env` files, Docker socket credentials, AppOps tokens, private host inventories, configuration exports, uploaded wallpapers or deployment keys.
- Keep bind addresses, AppOps endpoints, Unraid identity and browser-extension targets configurable; examples must use loopback or neutral placeholder hosts.
- Add tests for behavioural changes and run the documented frontend, backend, browser and managed validation gates.
- Explain security, permission, migration and deployment impact in the pull request.

Report vulnerabilities according to `SECURITY.md`.