Safeguard
Research•

How do you contribute to open source projects for the first time?

Pick a project you use, read its contributing guide, start with a small fix or docs change, open a focused pull request, and respond kindly to review.

Safeguard Security Team
5 min read

Pick a project you already use, read its README and contributing guide, find a small issue or documentation gap, fork the repository, make one focused change, and open a pull request that explains what and why. Respond to review patiently. Your first merged change matters less than learning how the project works.

Where should you start?

Start with something you use. You already know where it confuses you, and that is where documentation, error messages and examples are usually thin. The Open Source Guides, published by GitHub, suggest that contributions are not only code: documentation, design, triage and answering questions all count.

Then look for signs of a healthy project. Recent commits, maintainers who reply to issues, a contributing file, a code of conduct and issues labelled for newcomers all help. A project with years of unanswered pull requests will teach you patience and little else.

What should you read first?

Three files before you write anything.

The README tells you what the project is for and how to run it.

CONTRIBUTING tells you how maintainers want changes made: branch names, commit style, tests, sign-off requirements. GitHub documents that repository owners can add this file to set guidelines for contributors, and it is shown to people opening issues or pull requests.

The code of conduct sets how people treat each other. Read it. It also tells you someone will act if it is broken.

Some projects also require a contributor licence agreement or a developer certificate of origin sign-off. Check before you invest hours.

How do you make a good first change?

  1. Find or open an issue first for anything bigger than a typo. Ask whether the change is welcome.
  2. Fork the repository and clone your fork.
  3. Create a branch with a descriptive name.
  4. Make the smallest change that solves the problem. Do not mix a fix with a refactor.
  5. Run the existing tests and add one for your change.
  6. Commit with a clear message in the project's style.
  7. Push the branch to your fork and open a pull request.
  8. Explain the problem, your approach and how you tested it. Link the issue.

GitHub's documentation on contributing to a project walks through forking, branching and pull requests step by step.

What happens in review?

Expect questions, and sometimes requests that feel picky. Maintainers carry the long term cost of every line, so they care about style, tests and scope. Reply promptly, make the changes, and ask when you do not understand. If the answer is no, thank them. A declined change is common, and it is not a verdict on you.

Be patient with response time. Many maintainers are volunteers with other jobs. A polite single reminder after a couple of weeks is fine. Repeated pings are not.

How do you contribute safely?

Treat open source like any code that other people will run.

  • Do not commit secrets. Check your diff for keys, tokens and personal data before pushing.
  • Be careful with dependencies. Adding a new one to someone else's project is a significant decision, so justify it.
  • Do not copy code from sources whose licence you have not checked.
  • Use a separate email or account setup if you want to keep work and personal identities apart, and check your commit email setting.
  • If you find a security flaw, do not post it in a public issue. Look for a security policy file or contact route in the repository and report privately.

A constructed example

A developer uses a command line tool daily and notices its help text for a flag is wrong. She opens an issue, gets a thumbs up from a maintainer, fixes the text in one line, adds the note to the test snapshot and opens a pull request that cites the issue. It is merged in two days. Next month she picks a labelled bug in the same project, and the maintainers already know her name.

How to check or apply this

  1. Choose one project you use weekly.
  2. Read README, CONTRIBUTING and the code of conduct.
  3. Find a small issue, or write one about a gap you hit.
  4. Comment to say you are working on it.
  5. Make a focused change with a test.
  6. Open a clear pull request and respond to review within a few days.
  7. Repeat with something slightly larger.

Quick check

Do I have to write code to contribute?

No. Documentation, issue triage, translations, design and reproducing bugs are valued contributions.

What if I find a vulnerability in the project?

Report it privately through the project's security policy or listed contact. Do not post details in a public issue.

Sources

Last reviewed: 18 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.