Garak accepts probe and documentation contributions under a Linux Foundation DCO, enforced by bot at first PR, with one exception: security vulnerabilities must be reported privately to security@garak.ai following OWASP responsible-disclosure standards, never on GitHub. Contribution policy for Garak is documented in two locations: AGENTS.md (machine-readable, for automated agents) and docs/source/contributing.rst (human-readable); both must be kept in sync whenever the policy changes.
Security-related bugs and vulnerabilities must be reported privately by email to security@garak.ai, not via the public GitHub issue tracker.[1] Only responsibly disclosed vulnerabilities are accepted as probe contributions; CONTRIBUTING.md references the OWASP Vulnerability Disclosure Cheat Sheet as the standard for responsible disclosure.[1]
Contributors must sign the garak CA/DCO (contributor agreement / developer certificate of origin) — the same DCO the Linux Foundation requires — when submitting their first pull request; a bot automates this process on the PR.[1] A DCO (Developer Certificate of Origin) is a per-commit legal declaration affirming the contributor has the right to submit code under the project's open-source license, protecting both contributor and project from intellectual-property disputes.
The needs-triage label flags issues not yet reviewed by a maintainer; external contributors and automated agents must not pick up any issue carrying needs-triage or other needs-* labels (e.g., needs-maintainer) until those labels are cleared. Garak's GitHub issue templates (bug, docs, feature, plugin, question) automatically apply the needs-triage label on creation, routing every new issue through maintainer review before it is open for contribution.
Sources