Contributing

Rampart is Apache-2.0 licensed and welcomes contributions. Because this is security tooling written in a space with commercial, closed-source products, we follow strict clean-room rules.

Clean-room rulesCopy Anchor Link

1. Do not download, decompile, disassemble, inspect, diff or copy any proprietary RASP SDK, its binaries, sample apps or private documentation — not even to "check how they do it".
2. Base every detection on a public source: Android or Apple documentation, AOSP source, OWASP MASTG/MASVS/MASWE, a published paper or talk, or permissively licensed open-source code.
3. Name that source in a // Source: comment next to the check, and keep any third-party licence and attribution intact (Apache-2.0 NOTICE, MIT notices).
4. OWASP MAS content is CC BY-SA 4.0: link and attribute it, write documentation in your own words, and do not paste its text into Apache-2.0 files.
5. Sign off every commit (DCO: git commit -s) and tick the clean-room checkbox in the pull request.

Other rulesCopy Anchor Link

• No network code in the mobile package. CI will fail it.
• Never report personal data in evidence; use stable codes.
• Every new check needs a positive and a negative test and a documented bypass note.

Security issuesCopy Anchor Link

Please report vulnerabilities privately through GitHub security advisories, not in public issues.