# Contributing

## On Matrix

Currently, the Matrix room at [#grapevine:computer.surgery][room] serves
multiple purposes:

* General discussion about the project, such as answering questions about it
* Reporting issues with Grapevine, if getting GitLab access is too much trouble
  for you
* Providing support to users running Grapevine
* Discussing the development of Grapevine

If you'd like to engage in or observe any of those things, please join!

[room]: https://matrix.to/#/#grapevine:computer.surgery

## On GitLab

Instructions for getting GitLab access can be found on the [sign-in][sign-in]
page.

GitLab access is primarily useful if you'd like to open issues, engage in
discussions on issues or merge requests, or submit your own merge requests.

Note that if the sign-up process is too much trouble and you'd just
like to report an issue, feel free to report it in the Matrix room at
[#grapevine:computer.surgery][room]; someone with GitLab access can open an
issue on your behalf.

[sign-in]: https://gitlab.computer.surgery/users/sign_in

## Information about a vulnerability

If you find a security vulnerability in Grapevine, please privately report it to
the Grapevine maintainers in one of the following ways:

* Open a GitLab issue that's marked as confidential
* Create a private, invite-only, E2EE Matrix room and invite the following
  users:
  * `@benjamin:computer.surgery`
  * `@charles:computer.surgery`
  * `@xiretza:xiretza.xyz`

If the maintainers determine that the vulnerability is shared with Conduit or
other forks, we'll work with their teams to ensure that all affected projects
can release a fix at the same time.
