Thanks for your interest in contributing!
The full contributing guide — development setup, coding standards, testing, and the mandatory versioning & changelog discipline — lives in the documentation:
Contributions are accepted under the project's FSL-1.1-MIT license — see Licensing of Contributions.
In short: every PR that touches application code must bump /VERSION and add a matching CHANGELOG.md entry — CI enforces this. Security issues should be reported privately per SECURITY.md, not as public issues.