### CONTRIBUTING

## How to contribute to Two.js

#### **Do you have a question?**

* All questions answered by Two.js maintainers are in the [Issues](https://github.com/jonobr1/two.js/issues?q=label%3Aquestion) section of the project with the label question. Ensure the question was not already asked by checking there first.

* If you're unable to find a question that has been answered, [create one](https://github.com/jonobr1/two.js/issues/new?assignees=&labels=question&template=question.md&title=%5BQuestion%5D). Be sure to include a **title and clear description**, as much relevant information as possible, and a **code sample** in situ or on a third party site like [CodePen](http://codepen.io), [jsfiddle](http://jsfiddle.com), or [glitch](http://glitch.com). This helps us to better help you.

#### **Did you find a bug?**

* **Ensure the bug was not already reported** by searching on the project under [Issues](https://github.com/jonobr1/two.js/issues).

* If you're unable to find an open issue, [open a new one](https://github.com/jonobr1/two.js/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5BBug%5D). Be sure to include a **title and clear description**, as much relevant information as possible, and a **code sample** in situ or on a third party site like [CodePen](http://codepen.io), [jsfiddle](http://jsfiddle.com), or [glitch](http://glitch.com) demonstrating the issue.

#### **Did you write a patch that fixes a bug, add a new feature, or change an existing one?**

* Open a new GitHub pull request with the patch.

* Ensure the PR description clearly describes the problem and solution. Include the relevant issue number if applicable.

#### **Do you want to contribute to the Two.js documentation?**

* This is still in its infancy and if you're interested to help out, please send an email to [inquires@jono.fyi](mailto:inquiries@jono.fyi) with the subject "Two.js Documentation". In the body of your email please describe why or how you'd like to help.

Two.js is a volunteer effort, so we apologize in advance for any delays.

Thanks! For both taking the time to read this and contributing.

Much :heart: from the Two.js Team

---
This document is adapted from the [Ruby on Rails](https://github.com/rails/rails/blob/main/CONTRIBUTING.md#how-to-contribute-to-ruby-on-rails) project.

---

### SECURITY

# Security Policy

If you have discovered a security vulnerability in this project, please report it privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.

**You may submit the report in the following ways:**

- Github users can privately report security advisories directly [here](https://github.com/jonobr1/two.js/security/advisories/new)

- Send an email to [inquiries+two.js@jono.fyi](mailto:inquiries+two.js@jono.fyi).

**Please provide the following information in your report:**

- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit the issue

This project is maintained by volunteers on a reasonable-effort basis. As such, we ask that you give us 90 days to work on a fix before public exposure.

---

_Two.js conforms to this [Incident Response Plan](https://two.js.org/incident-response-plan) in moments of security risks._

---