# Contributing

Please open an issue before a large change. Keep parsing bounded, deterministic
and independent of network services. Treat every package field as untrusted;
never execute embedded code or inject package markup into the document.

Run `npm run check` and `npm run test:browser` before proposing a change. New
adapters need malformed, limit and missing-reference fixtures as well as normal
fixtures. Contributions are accepted under GPL-3.0-or-later.