# Contributing
Thank you for helping improve `captcha-sdk`.
## Development
Use stable Rust and keep provider modules feature-gated. Provider secrets,
tokens, API keys, private keys, and HMAC keys must never appear in logs, errors,
or `Debug` output.
Before opening a pull request, run:
```bash
cargo fmt --all --check
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo test --workspace --all-features --locked
cargo test --workspace --no-default-features --locked
```
Keep commits focused and describe user-visible changes in `CHANGELOG.md`.