docs(contributing): add review process and issue picking sections (closes #175)

CONTRIBUTING.md

@@ -4,6 +4,17 @@ Thanks for helping make DepRadar better. Start with an open issue labelled
 `good first issue` or `help wanted`, comment that you're picking it up, and
 open a PR that references it.
 
+## Picking an Issue
+
+Browse the [open issues](https://github.com/DepRadarOrg/DepRadar/issues) and look for the labels matching your focus:
+
+- **`Stellar Wave`**: Issues tracked and eligible for bounty payouts under the Drips Stellar Wave program. Make sure to include your Stellar public key in your PR description.
+- **`good first issue`**: Well-scoped tasks with clear definitions of done, ideal for your first contribution to DepRadar.
+- **`help wanted`**: Open tasks where community implementation or feedback is welcomed.
+- **Area labels** (`contract`, `frontend`, `client`, `scanner`, `typosquat`, `cve`, `cli`): Group issues by codebase layer so you can filter for your preferred stack.
+
+Before starting work, leave a comment on the issue stating that you are working on it to avoid duplicated efforts.
+
 ## Development Setup
 
 Prerequisites: a stable Rust toolchain, the `wasm32v1-none` target (for the
@@ -50,6 +61,28 @@ Some tests in `src/cve/` call the live [OSV API](https://osv.dev); they skip
 - Security-sensitive findings go through [SECURITY.md](SECURITY.md), not
   public issues.
 
+## Review Process
+
+### Response Times
+Maintainers typically review pull requests within **24–48 hours** on business days. If a PR has not received comments after 3 business days, a polite reminder comment on the PR thread is welcome.
+
+### Reviewer Checklist
+Every pull request is reviewed against the following criteria before approval:
+1. **CI Status**: All GitHub Actions workflows (`test`, `fmt`, `clippy`, `wasm`, `client` typecheck, and `frontend` CI) pass with 0 errors and 0 warnings.
+2. **Issue Linking**: The PR description references the related issue using GitHub keywords (e.g. `Closes #123`).
+3. **Progress Tracking**: An accurate entry is included in [PROGRESS.md](PROGRESS.md) adhering to the repository's log format.
+4. **Focused Diff**: The changeset remains focused on the issue's requirements without bundling unrelated formatting or dependency changes.
+5. **Testing**: New functionality, edge cases, and bug fixes are backed by appropriate unit, component, or contract tests.
+6. **Documentation**: Any newly introduced flags, configuration options, endpoints, or UI states are documented in the corresponding README.
+7. **Snapshot Consistency**: Contract changes include updated snapshots in `contracts/deprader_router/test_snapshots/`.
+
+### Common Reasons for Requested Changes
+- **Missing PROGRESS.md entry**: All merged contributions must be logged in `PROGRESS.md`.
+- **Failing CI or Unresolved Lints**: Clippy warnings or formatting differences fail the build; run `cargo fmt --all -- --check` and `cargo clippy` locally prior to push.
+- **Unrelated Changes**: Incidental edits to package locks, unrelated files, or scope creep should be removed or moved to dedicated PRs.
+- **Missing Tests**: Non-trivial changes or bug fixes submitted without test coverage.
+- **Secret Exposure**: Unintended commits containing keys or tokens.
+
 ## Closing Issues
 
 No issue is closed without an entry in [PROGRESS.md](PROGRESS.md)

PROGRESS.md

@@ -319,3 +319,11 @@ is closed — see [CONTRIBUTING.md](CONTRIBUTING.md).
 - **By:** ALLEN-AYODEJI
 - **Closes:** N/A
 - **Status:** Merged.
+
+### Documentation — PR review process & issue picking guide
+
+- **What:** Expands `CONTRIBUTING.md` with a "Picking an Issue" section guiding contributors on Stellar Wave bounty tracking and area labels, and a comprehensive "Review Process" section detailing response times (24–48 hours), the 7-item reviewer checklist, and common reasons for requested changes.
+- **Verified:** All links, Markdown syntax, and section references verified.
+- **By:** dezzy-music
+- **Closes:** #175
+- **Status:** PR open.