Project governance#
Vulnerability-Lookup is an open source project led by the core developers listed
in MAINTAINERS.md and supported by
CIRCL. The project welcomes participation from anyone
who follows the Code of Conduct.
Roles#
Contributors report issues, propose changes, review work, improve documentation, or otherwise participate in the project.
Maintainers are the project’s core developers. They lead the project, establish its technical direction, triage issues and pull requests, review and merge changes, manage releases, and safeguard its community standards.
Maintainers are listed in MAINTAINERS.md. The list is
updated through the normal pull-request process. Sustained, constructive
contributions and sound technical judgement are the basis for adding a
maintainer. A maintainer who is no longer active may ask to be removed, or the
remaining maintainers may remove them after consultation.
Development methodology#
The project relies on the Programming Methodology Framework (PMF) to guide its development practices. The core developers apply PMF to keep the project’s implementation, review, and evolution practical and consistent while retaining final responsibility for the project’s direction.
Decisions#
Routine decisions are made transparently in GitHub issues and pull requests. Maintainers seek rough consensus, taking into account technical correctness, security, backwards compatibility, operational impact, and the needs of users and contributors. A maintainer with a conflict of interest should disclose it and let another maintainer review the change.
For a change with broad or incompatible effects, open a feature-request issue
before implementation. Summarize the motivation, alternatives, migration
impact, and proposed outcome so the community can comment. If consensus cannot
be reached, the maintainers make the final decision and document the rationale
in the issue or pull request. Security-sensitive decisions may be handled
privately under the process in SECURITY.md until disclosure is
safe.
Contributions and releases#
The contribution workflow, branching model, and development conventions are
documented in docs/contributing.md. Pull requests are
reviewed by a maintainer and must satisfy the relevant automated checks before
merge. The main branch is the stable integration branch; releases and notable
changes are recorded in CHANGELOG.md.
No contributor licence agreement#
Vulnerability-Lookup follows a CLA-free policy: contributors are not required to sign a Contributor Licence Agreement or transfer copyright to a single organization. Contributions are accepted under the project’s GNU Affero General Public License version 3. Each contributor retains copyright in their contribution and joins the community of copyright holders—collectively, the co-owners of the project. This distributed ownership helps ensure that no single party can make the shared work proprietary and that Vulnerability-Lookup remains open source.
Scope and roadmap#
The project’s current priorities and the way roadmap items are proposed and
tracked are described in ROADMAP.md. Governance changes use the
same public issue and pull-request process as code changes.