# Contributing

Keep parsing bounded, output inert, and network execution absent. Parser or
reference changes need malformed, traversal, alias, cycle and limit tests.
Generation must disclose loss or heuristics. Run `npm run check` and both
Playwright projects, and update the changelog/security boundary.