Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
83 lines (60 loc) · 2.54 KB

CONTRIBUTING.md

File metadata and controls

83 lines (60 loc) · 2.54 KB
Raw

Contributing to VulnGRC

First off — thank you. VulnGRC exists because the GRC community deserves hands-on learning tools, not just slide decks.

Ways to Contribute

1. Add a New Challenge

The highest-impact contribution. A good challenge:

  • Is grounded in a realistic GRC scenario
  • Has a specific artifact to examine (not just "read about X")
  • Has a clear, measurable answer
  • Has a solution guide that explains the why, not just the what
  • References at least one real framework control

Template: Copy challenges/beginner/CH-01-policy-gap-analysis.md and modify.

2. Add a New CTF Challenge

GRC CTFs are rare. If you can create one:

  • The flag must be discoverable through GRC analysis, not guessing
  • The flag must be hidden inside a document in a realistic way
  • The scenario must reflect a real-world governance failure
  • Submit both the challenge and the flag to maintainers via private message (don't put the flag in the PR)

3. Add NexaCorp Artifacts

More broken documents = more learning opportunities.

  • New policy with planted gaps (follow existing pattern)
  • New Excel artifact (vendor questionnaire, BCP, DR plan)
  • New scenario (M&A due diligence, regulatory examination, breach simulation)

4. Add Framework Coverage

Currently missing:

  • DORA (Digital Operational Resilience Act)
  • NIS2 Directive
  • CCPA / CPRA
  • HIPAA Security Rule
  • SOX IT Controls
  • SWIFT CSCF

5. Translations

GRC is global. Translating challenges (not artifacts — keep those in English for realism) helps non-English speaking learners.

Languages most requested:

  • Spanish
  • French
  • Portuguese
  • Arabic
  • Japanese

6. Fix Bugs

If you find a gap that was unintentional (a mistake vs a planted issue), open an issue. Label it unintentional-bug.

Submission Guidelines

  1. Fork the repository
  2. Create a branch: feature/challenge-name or fix/bug-description
  3. Follow existing naming conventions
  4. Test your work — if it's a script, run it. If it's a challenge, have someone else attempt it.
  5. Open a Pull Request with a description of what you added and why

Code of Conduct

VulnGRC is a learning tool for defenders. Contributions that:

  • Could facilitate real attacks on real systems
  • Include actual credentials, real PII, or real company data
  • Are discriminatory or hostile

...will be rejected immediately.

Questions?

Open a GitHub Discussion. The community will help.

"If you've learned something from VulnGRC, the best way to say thank you is to add something that helps the next person learn."