From bfeb30494e6ba3cb4c4b7583e56e774b99eb2c20 Mon Sep 17 00:00:00 2001
From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com>
Date: Fri, 11 Sep 2026 15:12:59 -0400
Subject: [PATCH] CONTRIBUTING + PR template: same contribution model as the
 cache repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Business-model work order §4 applied to www: no outside code, issues and
private security reports wanted and credited, PRs stay enabled for our
own tooling.
---
 .github/PULL_REQUEST_TEMPLATE.md |  2 ++
 CONTRIBUTING.md                  | 19 +++++++++++++++++++
 bin/check-file-allowlist.sh      |  2 ++
 3 files changed, 23 insertions(+)
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md
 create mode 100644 CONTRIBUTING.md

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..9d37356
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+We don't take code contributions right now — see [CONTRIBUTING.md](../CONTRIBUTING.md).
+Spotted a wrong or misleading claim, a typo, or a security issue? File an issue (or a private vulnerability report) and we'll act on it — credited.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..e6202f5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,19 @@
+# Contributing
+
+This repository is the fosterstack.com website, and the same contribution
+model as [fosterstack/cache](https://github.com/fosterstack/cache/blob/main/CONTRIBUTING.md)
+applies: **we don't take code contributions right now.** Not a judgment of
+anyone's work — the implementation here is done by AI agents under automated
+gates, and an outside diff is the one input that can't go through those
+gates unreviewed.
+
+What we want, and will act on:
+
+- **Issues** — a typo, a claim that reads wrong, a page that misled you, an
+  accessibility problem. Copy corrections move fastest of all.
+- **Security reports** for anything on the site, through GitHub's private
+  vulnerability reporting. Send the report, not the patch; you'll be
+  credited in the fix.
+
+Pull requests stay enabled for our own tooling; an outside PR gets a
+friendly close with a link here and its substance re-filed as an issue.
diff --git a/bin/check-file-allowlist.sh b/bin/check-file-allowlist.sh
index a3f738d..a9dea35 100755
--- a/bin/check-file-allowlist.sh
+++ b/bin/check-file-allowlist.sh
@@ -11,6 +11,8 @@
 set -euo pipefail
 
 ALLOW_PATTERNS=(
+  '^CONTRIBUTING\.md$'
+  '^\.github/PULL_REQUEST_TEMPLATE\.md$'
   '^index\.html$'
   '^README\.md$'
   '^LICENSE$'