Blackfyre is Apache-2.0 and built in the open via the standard fork-and-PR flow — 55 auditors, 9 frameworks, 678 controls. Add a cloud auditor, map a new framework as data, fix a bug, or sharpen the docs. Here's exactly how a change gets from your fork to merged.
Ground rules
Apache-2.0
License
9
Frameworks as data
678
Controls
DCO
Sign-off required
Contribute via
The whole path is the standard fork-and-PR flow, with two hard requirements: a DCO sign-off on every commit and a green pre-PR build + unit-test gate.
01 · Fork & clone
Fork the repo on GitHub and clone your fork. Every change lands via a pull request from your fork — nobody pushes directly to main.
02 · Branch off main
Cut a topic branch off main for your change (git checkout -b feat/short-description). Never commit to main directly.
03 · Conventional Commits
Write messages Conventional-Commits style — a type prefix (feat, fix, docs, ci, chore, refactor, test), an optional scope, and an imperative summary.
04 · Sign off — DCO, mandatory
Sign off every commit with git commit -s. The Signed-off-by trailer certifies, under the Developer Certificate of Origin, that you can license the change under Apache-2.0. Unsigned commits fail CI and cannot merge.
05 · Build + unit tests
Run the pre-PR gate locally — npm run build and the offline unit suite (npm run test:unit) — the same checks CI runs. Both must pass or merge is blocked.
06 · Open a pull request
Push your branch and open a PR against main. Link the issue, keep it small and focused, split unrelated changes. Draft PRs are welcome for early feedback.
07 · CI + review, then merge
CI installs, builds, runs the unit suite, and verifies the DCO sign-off on every commit. Green checks plus a maintainer approval, and it merges.
What CI checks on every PR
npm ciDependency installnpm run buildBuild all packagesnpm run test:unitOffline, fully-mocked unit suiteDCOSign-off on every commitA PR must be green before it can merge. Open an issue first for anything beyond a small fix — it avoids duplicate work on changes that don't fit the roadmap.
The DCO sign-off, every commit
git commit -s -m "feat: add scan result pagination"Forgot to sign off? git commit --amend -s && git push --force-with-lease
Straight from the roadmap. New frameworks and docs are the most well-scoped first contributions; scanners and triage are the deep end.
Frameworks land as data
Control catalogs and mappings in packages/shared — no engine changes.
Docs PRs are first-class
Keeping the ~15-minute local setup honest on a fresh clone counts.
Triage is a real path
Sustained review and labelling is the road from contributor to committer.
Deepen AWS/Azure/GCP coverage — more services, more checks — or give the Prowler and IaC container scanners a better local story. Every agent normalizes through one findings path.
Read ADR-0003New frameworks land as data — control catalogs and mappings in packages/shared, not code. Well-scoped and a great first contribution beyond the shipped nine.
See the roadmapKeep the 15-minute local setup honest on a fresh clone, sharpen the developer docs, or improve an ADR. Documentation PRs are first-class here.
Local developmentHelp reproduce reported bugs, label incoming issues, and review open pull requests. Sustained, quality help here is the path from contributor to committer.
Browse issuesThe honest state of a young project, not its end state — and the door from contributor to committer is open. Blackfyre adopts the Contributor Covenant v2.1 across every project space.
How decisions are made
Blackfyre currently uses a BDFL model: the project founder is the maintainer and has final say on the roadmap and merges. Everyone submits PRs under the DCO, and all merged code is Apache-2.0.
Read GOVERNANCE.mdContributor → committer
Triage and review count. Sustained help maintaining the project is the fastest way there.
Code of Conduct
We expect a welcoming, harassment-free experience for everyone. The Code of Conduct covers all project spaces and includes the enforcement contact and escalation ladder — it applies to your first issue as much as your hundredth PR.
Read the Code of ConductEverything, in the repo · the canonical docs behind this page
The fork-and-PR flow, mandatory DCO sign-off, Conventional Commits style, the pre-PR build + unit-test gate, and what CI checks — the source for a /contribute page.
The current BDFL model, how decisions are made, and the path from contributor to committer.
Near/mid/long-term direction (contributor experience, community releases, scanner coverage, a scanner plugin API, more frameworks as data, non-AWS deployment) and how to propose work via an issue.
Contributor Covenant v2.1 covering all project spaces, with the enforcement contact and escalation ladder.
Private vulnerability disclosure process, response SLAs, in-scope vs out-of-scope, security practices, and compliance posture.
Grab a well-scoped issue, sign off your commits, and open a PR. Apache-2.0 — self-host it free, and shape where it goes.