From 909db889f3e635fd53c74b8e5c145e41df907160 Mon Sep 17 00:00:00 2001
From: Reggiebro <reggiebro@users.noreply.github.com>
Date: Thu, 15 Oct 2026 04:41:52 +0200
Subject: [PATCH] docs: add Labels section to CONTRIBUTING.md

Documents every area label (typosquat, scanner, contract, frontend, ...)
and workflow label (bug, good first issue, Stellar Wave, ...) in two
tables, with guidance on when each is used. Notes that Stellar Wave is
maintainer-applied for Drips funding eligibility and should not be
self-assigned.

Adds the required PROGRESS.md entry.

Closes #185
---
 CONTRIBUTING.md | 54 +++++++++++++++++++++++++++++++++++++++++++++++++
 PROGRESS.md     | 14 +++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bb75b5c..7a2589b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -50,6 +50,60 @@ Some tests in `src/cve/` call the live [OSV API](https://osv.dev); they skip
 - Security-sensitive findings go through [SECURITY.md](SECURITY.md), not
   public issues.
 
+## Labels
+
+Issues and pull requests are organised with two kinds of labels: **area**
+labels that point at the part of the codebase involved, and **workflow**
+labels that describe triage state. Use one area label per issue; add more
+only when a change genuinely spans several areas.
+
+### Area labels
+
+| Label | Use it for |
+|---|---|
+| `typosquat` | Typosquat detection (`src/typosquat/`) |
+| `scanner` | Lockfile parsing and the scan pipeline |
+| `crawler` | Registry crawlers and monitors |
+| `cve` | Known-vulnerability matching (`src/cve/`) |
+| `contract` | The Soroban bounty-router contract |
+| `client` | Testnet read client (`client/`) |
+| `frontend` | Web dashboard (`frontend/`) |
+| `wallet` | Wallet-connected write actions |
+| `cli` | The `depradar` command-line tool |
+| `npm` | npm ecosystem |
+| `pypi` | PyPI ecosystem |
+| `crates` | crates.io ecosystem |
+| `drips` | Drips integration |
+| `data` | Datasets |
+| `security` | Security hardening or detection |
+| `performance` | Speed, size or resource usage |
+| `accessibility` | Barrier affecting people with disabilities |
+| `behavioral` | Behavioral / malware heuristics |
+| `testing` | Tests, fixtures and test infrastructure |
+| `ci` | CI, release and automation |
+| `devex` | Developer experience and tooling |
+| `tooling` | Scripts and tooling |
+| `design` | Visual and UX design |
+
+### Workflow labels
+
+| Label | Meaning |
+|---|---|
+| `bug` | Something isn't working |
+| `enhancement` | New feature or request |
+| `documentation` | Improvements or additions to documentation |
+| `question` | Further information is requested |
+| `good first issue` | Good for newcomers — self-contained and low-risk |
+| `help wanted` | Extra attention is needed |
+| `duplicate` | This issue or pull request already exists |
+| `invalid` | This doesn't seem right |
+| `wontfix` | This will not be worked on |
+| `Stellar Wave` | Eligible for the Drips Stellar Wave program |
+
+`Stellar Wave` is applied by maintainers to issues that qualify for the
+[Drips](https://www.drips.network) funding round — don't add it yourself,
+but you may filter by it to find work that's eligible for a payout.
+
 ## Closing Issues
 
 No issue is closed without an entry in [PROGRESS.md](PROGRESS.md)
diff --git a/PROGRESS.md b/PROGRESS.md
index bab63fb..2e22780 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -319,3 +319,17 @@ is closed — see [CONTRIBUTING.md](CONTRIBUTING.md).
 - **By:** ALLEN-AYODEJI
 - **Closes:** N/A
 - **Status:** Merged.
+
+### Contributing docs — Labels section
+
+- **What:** Adds a **Labels** section to `CONTRIBUTING.md` documenting every
+  area label (`typosquat`, `scanner`, `contract`, `frontend`, …) and every
+  workflow label (`bug`, `good first issue`, `Stellar Wave`, …), split into
+  two tables, with guidance on when each is used. Notes that `Stellar Wave`
+  is maintainer-applied for Drips funding eligibility and should not be
+  self-assigned.
+- **Verified:** every label name and description matches the live label set
+  on the repository; the Drips link resolves.
+- **By:** Reggiebro
+- **Closes:** #185
+- **Status:** Merged.