Skip to content

docs: open DriftGuard to reproducible external engineering review #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
EdwinJdevops wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: open DriftGuard to reproducible external engineering review #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Contributing to DriftGuard

DriftGuard is an AWS/Terraform drift-analysis project. Contributions that improve correctness, reproducibility, and the safety of its recommendations are particularly useful.

## Before opening a pull request

1. Read the [README](README.md), including documented limitations.
2. Search [existing issues](https://github.com/EdwinJdevops/driftguard/issues) and [pull requests](https://github.com/EdwinJdevops/driftguard/pulls).
3. For a bug, include a minimal reproduction, actual output, expected output, and the affected commit or version. **Remove account IDs, credentials, Terraform state secrets, customer data, and private infrastructure identifiers.**
4. Prefer a small change with a regression test over a broad refactor. Explain failure behavior and possible security implications.
5. Record commands you actually ran and their results. Do not claim a test passed if it was not executed.

## Review targets

The following questions are useful areas for independent review, not statements that they have been fully addressed:

- Can a partial or failed AWS inventory be misinterpreted as a resource deletion?
- Can one tenant retrieve another tenant's scan results? See [the existing access-control issue](https://github.com/EdwinJdevops/driftguard/issues/2).
- Are AWS permissions scoped, and are failure modes visible rather than silently ignored?
- Can generated remediation suggestions damage an existing Terraform configuration?
- Does logging or an API response expose credential material, Terraform state secrets, or infrastructure identifiers?

## Submitting a change

In the pull request, document:

- **Problem:** input and condition that triggers the behavior.
- **Change:** what the patch actually changes.
- **Evidence:** reproducible test or demonstration and exact commands executed.
- **Risk:** expected compatibility, authorization, or deployment impact.
- **Limits:** cases the change does not cover.

An external reproduction that disproves a documented assumption is a valuable contribution, even if it does not arrive with a patch.

## Security reports

**Do not publish exploitable vulnerabilities or secrets in public issues.** Before reporting a security-sensitive finding, check the repository's Security tab for a private vulnerability reporting option. If it is unavailable, do not post exploit details publicly.

## Licensing

Before copying, redistributing, or modifying this code, verify that the repository contains an applicable license. Public visibility alone does not grant reuse rights. This contribution guide does not grant a software license.

No one is expected to claim production qualification on behalf of this project. Review the exact scope of each test or experiment.
Loading