chore: prepare repository for open-source release

1 files changed, 37 insertions, 0 deletions

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..99a1bf5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,37 @@
+<!--
+  Author:  cirakg & claude ai
+  Summary: Development checks, safe test data and contribution licensing.
+-->
+# Contributing
+
+Bug reports and focused patches are welcome. Include the app version, watch model, reproduction steps, and expected and actual behavior. Use fabricated entries in examples, logs and screenshots. See [SECURITY.md](SECURITY.md) for vulnerability reports.
+
+## Development
+
+Follow the Docker setup in the [README](README.md) and the [developer guide](docs/DEVELOPER_GUIDE.md). Use `make test-tools` for Python tooling changes, `make test` for application tests, `make lint` for static checks, and `make docs` for documentation. UI changes should also pass `make screenshots`; review image differences before approving new golden images. Before a release, run `make ci ALL=1` for the full device matrix. Routine checks default to `fr70`.
+
+Describe what changed and how you verified it. Keep expensive work in resumable jobs and preserve the app's no-network-permissions design. The [project plan](docs/PROJECT_PLAN.md) preserves the original numbered design sections referenced in source comments and historical changelog entries.
+
+## Secrets and private data
+
+Never commit signing keys, Garmin credentials, SDK/device downloads, real OTP seeds, authenticator exports, watch storage dumps, or screenshots containing real accounts or barcodes. `.gitignore` covers common filenames, but cannot identify every private file. Keep personal test data outside this checkout. The checked-in fixtures use published RFC keys and fabricated accounts; they must never be used for real accounts.
+
+Install [Gitleaks](https://github.com/gitleaks/gitleaks) v8.25.0 or newer for secret scanning. Scan all reachable history before publishing:
+
+```sh
+gitleaks git --log-opts=--all --redact --no-banner .
+```
+
+Optionally enable the staged-file check for each commit (requires Gitleaks on the host):
+
+```sh
+git config core.hooksPath .githooks
+```
+
+The checked-in configuration extends Gitleaks' default detectors and allows only specific reviewed test values in specific fixture files. Review new findings; do not suppress a whole test folder. Git history also preserves deleted data and commit author emails. If a real credential is committed, revoke or rotate it before arranging history cleanup.
+
+## Licensing
+
+By submitting a contribution, you agree to license your original work under GPL-3.0-only, as described in [LICENSE](LICENSE). Preserve upstream notices when using third-party material and update [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). Garmin's SDK and device files have their own terms and must not be added to the repository.
+
+When distributing a binary, include the license and upstream notices copied into `build/package/` by `make package`, and provide the corresponding source, including build scripts and any modifications. A Store upload alone does not supply that source: publish the matching source version and make its location available to recipients.