# Contributing
Thank you for taking the time to look at Synheart Sensor Agent. This document
explains how this repository accepts contributions.
## TL;DR
- **Issues are welcome.** Bug reports, feature requests, and questions help us
prioritize and improve the collector.
- **Pull requests are not accepted at this time.** Any externally submitted PR
will be closed without review.
- **Security reports are not public.** See [SECURITY.md](SECURITY.md) for the
private disclosure path.
## Why we do not accept pull requests
This agent is developed in an internal monorepo and mirrored to GitHub for
transparency. The public repository is source-available so anyone can read,
audit, and learn from the code that runs on their device — but the project is
not yet ready to absorb external code contributions.
Specifically:
- **Privacy invariants.** The collector's core guarantee is that it never
captures key content or cursor coordinates. Every change is reviewed against
that invariant internally; we cannot delegate that review to the PR queue.
- **Spec stability.** The event model is still evolving against internal RFCs.
Accepting external changes before it settles would create churn for everyone,
including contributors.
- **Review capacity.** A small team maintains this code. We would rather invest
review time in hardening the privacy guarantees than in bouncing PRs back for
rework.
- **Provenance.** We avoid contributor licensing overhead (CLAs, copyright
assignment) by sourcing all code internally.
This is a temporary policy and may relax once the event model is stable. Until
then, issues are the supported way to influence the direction of the agent.
## Privacy guarantees
Even when filing bugs or feature requests, do not share user content (typed
text, key codes, screen content, application content, PII). This agent is
designed to capture only timing, category, and magnitude metadata; reports that
include user content will be redacted or closed.
## Filing an issue
Before opening an issue, please:
1. Search [existing issues](https://github.com/synheart-ai/synheart-sensor-agent/issues)
to avoid duplicates.
2. Use the appropriate issue template (bug report or feature request).
3. Include enough detail for us to reproduce or evaluate the request — version,
OS and version, permission state (`synheart-sensor status`), and what you
expected vs. observed.
Issues that are well scoped and reproducible get triaged faster.
## What about typo / docs fixes?
Even small documentation fixes are best filed as an issue. Quote the section,
suggest the change, and we will roll it into the next internal sync. This keeps
a single contribution path and avoids ambiguity about what is in scope.
## Code of conduct
This project follows a [Code of Conduct](CODE_OF_CONDUCT.md) that all
participants are expected to adhere to. Be respectful in issues and discussions.
We reserve the right to close issues that are abusive, off-topic, or used to
spam the tracker.