Open an issue before a large change so the privacy-first, browser-only scope is clear. Pull requests should explain the user problem, keep file processing local, include focused tests, update affected documentation, and pass npm run check plus npm audit.
Do not commit recipient data, client templates, generated personal documents, credentials, licensed fonts, or assets without redistribution rights. Changes that add accounts, servers, telemetry, remote runtime code, email delivery, or hosted verification require an explicit security and privacy design rather than an incidental dependency.
Contributions are reviewed for correctness, accessibility, scope, dependencies, licensing, security, and honest product claims. Passing automation does not guarantee acceptance.