# Contributing to CSPKit

Thanks for helping improve CSPKit. Contributions should stay within the project's boundary: CSP policy text parsing, auditing, fallback calculation, scoring, reporting, templates, or policy diff.

## Local checks

Run these commands before opening a pull request:

```bash
moon fmt --check
moon info
moon check --deny-warn
moon build
moon test --deny-warn
moon run cmd/main
```

## Change expectations

- Add or update tests for behavior changes.
- Keep public API names and error behavior documented in the README or design notes.
- Update `CHANGELOG.md` for user-visible changes.
- Explain security-sensitive assumptions and unsupported CSP behavior.
- Do not add copied code, private code, source-unknown generated content, or unlicensed fixtures.
- Keep commits focused and meaningful so the development process remains reviewable.

Pull requests should describe the motivation, affected API, test commands, and any compatibility or license considerations.