Skip to content

Commit 3ee901f

Browse files
devploitdevploit
committed
docs: add community standards files
1 parent 40e7b6c commit 3ee901f

8 files changed

Lines changed: 380 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Bug report
2+
description: Report a reproducible problem with NoMore403.
3+
title: "[Bug]: "
4+
labels:
5+
- bug
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Thanks for reporting a bug. Do not include credentials, tokens, private target data, customer data, or non-public vulnerability details.
11+
12+
If this is a vulnerability in NoMore403 itself, do not file a public issue. Follow SECURITY.md instead.
13+
- type: input
14+
id: version
15+
attributes:
16+
label: Version or commit
17+
description: Paste the release version, commit SHA, or note if you built from the default branch.
18+
placeholder: "vX.Y.Z or commit SHA"
19+
validations:
20+
required: true
21+
- type: input
22+
id: environment
23+
attributes:
24+
label: Environment
25+
description: Include OS, architecture, shell, and Go version if building from source.
26+
placeholder: "macOS 15 arm64, zsh, Go 1.24"
27+
validations:
28+
required: true
29+
- type: textarea
30+
id: command
31+
attributes:
32+
label: Command
33+
description: Paste the exact command and flags. Redact hostnames or sensitive headers if needed.
34+
render: shell
35+
placeholder: "./nomore403 -u https://example.test/admin -v"
36+
validations:
37+
required: true
38+
- type: textarea
39+
id: expected
40+
attributes:
41+
label: Expected behavior
42+
description: What did you expect to happen?
43+
validations:
44+
required: true
45+
- type: textarea
46+
id: actual
47+
attributes:
48+
label: Actual behavior
49+
description: What happened instead? Include output when safe to share.
50+
render: text
51+
validations:
52+
required: true
53+
- type: textarea
54+
id: reproduce
55+
attributes:
56+
label: Reproduction steps
57+
description: Provide the smallest reproduction you can. Prefer a local or public test target.
58+
placeholder: |
59+
1. Build with ...
60+
2. Run ...
61+
3. Observe ...
62+
validations:
63+
required: true
64+
- type: textarea
65+
id: extra
66+
attributes:
67+
label: Additional context
68+
description: Add logs, screenshots, request/response shapes, or notes. Redact sensitive details.
69+
validations:
70+
required: false

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability in NoMore403
4+
url: https://github.com/devploit/nomore403/security/advisories/new
5+
about: Please report vulnerabilities in the project privately instead of opening a public issue.
6+
- name: Usage question
7+
url: https://github.com/devploit/nomore403#readme
8+
about: Check the README first, then open a feature request if the documentation or workflow should change.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Feature request
2+
description: Suggest a new feature, behavior, or workflow improvement.
3+
title: "[Feature]: "
4+
labels:
5+
- enhancement
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Use this for product behavior, workflow, output, or documentation improvements. For new bypass techniques or payloads, the dedicated technique template is usually better.
11+
- type: textarea
12+
id: problem
13+
attributes:
14+
label: Problem or use case
15+
description: What workflow or limitation should this address?
16+
placeholder: "When testing authorized targets, I want to..."
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: proposed
21+
attributes:
22+
label: Proposed solution
23+
description: Describe the behavior you want.
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: alternatives
28+
attributes:
29+
label: Alternatives considered
30+
description: Mention any existing flags, workflows, or tools you tried.
31+
validations:
32+
required: false
33+
- type: textarea
34+
id: examples
35+
attributes:
36+
label: Examples
37+
description: Add example commands, output shape, or documentation changes if useful.
38+
render: text
39+
validations:
40+
required: false

‎.github/ISSUE_TEMPLATE/technique_or_payload.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Technique or payload proposal
2+
description: Propose a new bypass technique, request mutation, or payload list change.
3+
title: "[Technique]: "
4+
labels:
5+
- enhancement
6+
- technique
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Keep examples focused on authorized testing. Do not include private target data, credentials, tokens, customer data, or non-public vulnerability details.
12+
- type: textarea
13+
id: behavior
14+
attributes:
15+
label: Behavior being tested
16+
description: What parser, proxy, CDN, WAF, framework, routing, normalization, or trust-boundary behavior does this exercise?
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: request_shape
21+
attributes:
22+
label: Example request shape
23+
description: Show the request mutation or payload. Use example.test or a local target.
24+
render: text
25+
validations:
26+
required: true
27+
- type: textarea
28+
id: difference
29+
attributes:
30+
label: Difference from existing techniques
31+
description: Explain why this is not already covered by current techniques or payload files.
32+
validations:
33+
required: true
34+
- type: textarea
35+
id: expected_output
36+
attributes:
37+
label: Expected output or signal
38+
description: What status, body, redirect, scoring, replay, or filtering behavior should NoMore403 surface?
39+
validations:
40+
required: false
41+
- type: textarea
42+
id: references
43+
attributes:
44+
label: References
45+
description: Link public references, writeups, specs, or local reproduction details when available.
46+
validations:
47+
required: false

‎.github/pull_request_template.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
## Summary
2+
3+
Describe what this pull request changes and why.
4+
5+
## Type of Change
6+
7+
- [ ] Bug fix
8+
- [ ] New technique or payload behavior
9+
- [ ] Documentation update
10+
- [ ] Refactor or maintenance
11+
- [ ] Release or build change
12+
13+
## Testing
14+
15+
- [ ] `gofmt -w .`
16+
- [ ] `go test ./...`
17+
- [ ] `go build ./...`
18+
- [ ] Manual testing, if relevant:
19+
20+
## Security and Responsible Use
21+
22+
- [ ] This change does not include private target data, credentials, tokens, customer data, or non-public vulnerability details.
23+
- [ ] This change is intended for authorized testing workflows.
24+
- [ ] New request behavior is documented or covered by tests where practical.
25+
26+
## Notes for Reviewers
27+
28+
Call out any risky areas, tradeoffs, or follow-up work.

‎CODE_OF_CONDUCT.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Code of Conduct
2+
3+
## Our Pledge
4+
5+
We want NoMore403 to be a practical, respectful, and useful project for people working on authorized web security testing.
6+
7+
Everyone participating in this project is expected to help maintain a professional environment. This applies to issues, pull requests, discussions, code review, documentation, and any other project space.
8+
9+
## Expected Behavior
10+
11+
Examples of behavior that helps the project:
12+
13+
- Be respectful when discussing ideas, bugs, tradeoffs, and mistakes.
14+
- Assume good intent, but ask for clarification when something is unclear.
15+
- Keep feedback specific, technical, and actionable.
16+
- Respect different experience levels and communication styles.
17+
- Share evidence when reporting bugs or proposing behavior changes.
18+
- Redact secrets, private targets, customer data, tokens, and vulnerability details that should not be public.
19+
- Use NoMore403 only on systems you are authorized to test.
20+
21+
## Unacceptable Behavior
22+
23+
Examples of behavior that is not acceptable:
24+
25+
- Harassment, intimidation, threats, or personal attacks.
26+
- Insults, discriminatory language, or sexualized content.
27+
- Publishing someone else's private information without permission.
28+
- Repeated off-topic posting or disruption of project work.
29+
- Encouraging misuse of the tool against systems without authorization.
30+
- Posting active exploit details, credentials, private target data, or sensitive vulnerability information in public project spaces.
31+
32+
## Reporting
33+
34+
If you see conduct that violates this code, contact the project maintainers through the repository's available maintainer contact channels.
35+
36+
For security vulnerabilities in NoMore403 itself, follow [SECURITY.md](SECURITY.md) instead of opening a public issue.
37+
38+
## Enforcement
39+
40+
Maintainers may remove content, edit or close issues, reject contributions, or restrict participation when behavior harms the project or its contributors.
41+
42+
Enforcement decisions should be proportional, consistent, and focused on keeping the project safe and productive.

‎CONTRIBUTING.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Contributing to NoMore403
2+
3+
Contributions are welcome. Useful areas include bug fixes, better payloads, new bypass techniques, raw HTTP improvements, frontend fingerprinting, tests, and documentation.
4+
5+
## Responsible Use
6+
7+
NoMore403 is intended for authorized security testing, bug bounty work, penetration testing, security reviews, and regression testing.
8+
9+
Do not include private target data, credentials, tokens, customer data, or non-public vulnerability details in issues, pull requests, commits, tests, fixtures, or screenshots. Redact real hostnames unless they are intentionally public test targets.
10+
11+
If you need to report a vulnerability in NoMore403 itself, follow [SECURITY.md](SECURITY.md).
12+
13+
## Development Setup
14+
15+
Requirements:
16+
17+
- Go 1.24 or later
18+
- `curl` in `PATH` for techniques that exercise curl-based request behavior
19+
20+
Build and test locally:
21+
22+
```bash
23+
go test ./...
24+
go build ./...
25+
```
26+
27+
Before opening a pull request, format Go code:
28+
29+
```bash
30+
gofmt -w .
31+
```
32+
33+
## Project Structure
34+
35+
- `main.go`: CLI entry point
36+
- `cmd/`: command implementation, request logic, bypass techniques, output, and tests
37+
- `payloads/`: payload lists used by techniques
38+
- `README.md`: user-facing usage and behavior documentation
39+
40+
## Reporting Bugs
41+
42+
Please use the bug report template and include:
43+
44+
- NoMore403 version or commit SHA
45+
- operating system and architecture
46+
- Go version, if building from source
47+
- exact command and flags, with sensitive data redacted
48+
- expected behavior
49+
- actual behavior
50+
- minimal reproduction steps
51+
- relevant output, preferably with `-v` if it is safe to share
52+
53+
For target-specific behavior, use a local reproduction or a public test target when possible.
54+
55+
## Proposing Features or Techniques
56+
57+
Before adding a new technique, check that it represents a distinct behavior and is not already covered by existing path, header, method, frontend, or raw HTTP logic.
58+
59+
Good technique proposals usually include:
60+
61+
- the parsing, normalization, or trust-boundary behavior being tested
62+
- why the result differs from existing techniques
63+
- an example request shape
64+
- expected signals in output
65+
- tests that verify the generated request shape, filtering, scoring, or replay behavior
66+
67+
## Payload Changes
68+
69+
Payload list changes should stay focused. Avoid adding very large lists unless there is a clear reason and the runtime impact is acceptable.
70+
71+
When adding payloads, prefer entries that are:
72+
73+
- reproducible
74+
- meaningfully different from existing entries
75+
- useful across common frontend, proxy, CDN, WAF, or application stacks
76+
- documented in the pull request when the behavior is not obvious
77+
78+
## Pull Requests
79+
80+
Pull requests should be scoped and easy to review.
81+
82+
Before submitting:
83+
84+
- run `gofmt -w .`
85+
- run `go test ./...`
86+
- run `go build ./...`
87+
- update documentation if behavior, flags, output, or payload expectations change
88+
- add or update tests for code behavior changes
89+
90+
By contributing, you agree that your contribution will be licensed under the project's MIT License.

‎SECURITY.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
Security fixes are considered for the current default branch and the latest public release.
6+
7+
Older versions may not receive fixes unless the issue is severe and the patch is practical to backport.
8+
9+
## Reporting a Vulnerability
10+
11+
Please do not open a public issue for vulnerabilities in NoMore403 itself.
12+
13+
Use one of these private reporting paths:
14+
15+
1. Open a private vulnerability report through the repository's GitHub Security tab, if available.
16+
2. If private reporting is not available, contact the maintainer through the contact channel listed on the repository owner's GitHub profile.
17+
18+
Include as much of the following as you can:
19+
20+
- affected version or commit SHA
21+
- operating system and architecture
22+
- impact and attack scenario
23+
- reproduction steps
24+
- proof of concept, if safe to share privately
25+
- whether the issue is already public or known elsewhere
26+
- suggested fix, if you have one
27+
28+
Please do not include secrets, real third-party target data, customer data, or unrelated vulnerability details.
29+
30+
## Scope
31+
32+
In scope:
33+
34+
- vulnerabilities in NoMore403's source code, release artifacts, build process, or documentation that could harm users
35+
- command injection, unsafe file handling, unexpected network behavior, data exposure, or supply-chain risks caused by this project
36+
- vulnerabilities in generated output that could mislead users into unsafe handling of sensitive data
37+
38+
Out of scope:
39+
40+
- access-control bypasses found on third-party websites using NoMore403
41+
- reports about systems you are not authorized to test
42+
- scanner output without a clear impact on NoMore403 itself
43+
- denial-of-service reports that only involve intentionally scanning a target at high volume
44+
45+
Report findings on third-party targets to the target owner or their vulnerability disclosure program.
46+
47+
## Disclosure Process
48+
49+
The maintainers will try to acknowledge valid private reports promptly, investigate the issue, and coordinate a fix before public disclosure.
50+
51+
Please allow reasonable time for triage and remediation before publishing details.
52+
53+
## Responsible Use
54+
55+
NoMore403 is intended for authorized security testing. Users are responsible for complying with applicable law, program rules, and organizational policy.

0 commit comments

Comments
 (0)