procoder-ji · Nov 10, 2026 · Nov 10, 2026 · Nov 10, 2026
@@ -0,0 +1,2 @@
+# Route review requests to the existing project maintainer.
+* @procoder-ji
@@ -5,7 +5,11 @@ labels: [bug]
 body:
   - type: markdown
     attributes:
-      value: Before submitting, check whether this problem has already been reported.
+      value: |
+        Before submitting, check whether this problem has already been reported.
+        For setup questions, use Discussions. Report vulnerabilities privately through
+        [SECURITY.md](https://github.com/procoderji-com/procoderji/blob/main/SECURITY.md),
+        and remove credentials or personal data from logs and screenshots.
   - type: textarea
     id: summary
     attributes:

@@ -1 +1,11 @@
 blank_issues_enabled: false
+contact_links:
+  - name: Questions and setup help
+    url: https://github.com/procoderji-com/procoderji/discussions
+    about: Ask how to use the project or discuss a contribution before opening a bug report.
+  - name: Report a security vulnerability privately
+    url: https://github.com/procoderji-com/procoderji/blob/main/SECURITY.md
+    about: Follow the security policy instead of publishing an unpatched vulnerability in an issue.
+  - name: Report a conduct concern
+    url: https://github.com/procoderji-com/procoderji/blob/main/CODE_OF_CONDUCT.md#report-a-concern
+    about: Use the private reporting channel in the Code of Conduct.
@@ -3,6 +3,12 @@ description: Suggest an improvement for students or contributors.
 title: "feature: "
 labels: [enhancement]
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Check the roadmap, existing issues and open pull requests first. Describe the student
+        problem and the smallest useful outcome. Small bug fixes or documentation corrections
+        can go straight to a pull request without a separate feature request.
   - type: textarea
     id: problem
     attributes:

@@ -11,6 +11,10 @@ updates:
     # Major updates keep their own pull requests so breaking changes are reviewed
     # one at a time.
     groups:
+      npm-security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
       production-dependencies:
         dependency-type: production
         update-types:
@@ -33,6 +37,24 @@ updates:
       - dependency-name: "@types/node"
         update-types:
           - version-update:semver-major
+  - package-ecosystem: nuget
+    # Dependabot expands ProCoderJi.slnx here, covering the API and test projects
+    # together so shared .NET packages can move in one reviewed pull request.
+    directory: /backend
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    groups:
+      nuget-security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      nuget-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: github-actions
     directory: /
     schedule:

@@ -1,15 +1,14 @@
 ## Summary
 
-<!-- What changed and why? -->
+<!-- Describe the problem and resulting behavior. Link a related issue when one exists. -->
 
 ## Checks
 
-- [ ] `npm run lint`
-- [ ] `npm run typecheck`
-- [ ] `npm test`
-- [ ] `npm run build`
-- [ ] Browser checks, when the change affects routes or interactions
+<!-- List relevant commands and their results; explain anything not run.
+Frontend: lint, typecheck, tests, build. Backend: .NET tests and affected database contracts.
+Shared rules/questions need both runtimes. Routes/interactions need applicable browser/SEO checks.
+Documentation-only changes need wording and link review, not runtime tests. -->
 
 ## Review notes
 
-<!-- Add screenshots for visual changes. Mention content sources and licences when relevant. -->
+<!-- Add screenshots for visible UI changes, content sources/licences, and any operator steps. -->
@@ -71,9 +71,9 @@ jobs:
           --health-interval 5s --health-timeout 5s --health-retries 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6
         with:
           dotnet-version: 10.0.x
       - name: Restore locked backend dependencies

@@ -20,10 +20,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -49,16 +49,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
 
       - name: Set up .NET for browser checks
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6
         with:
           dotnet-version: 10.0.x
 
@@ -75,7 +75,7 @@ jobs:
 
       - name: Upload browser failure screenshots
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: browser-screenshots-${{ github.run_attempt }}
           path: e2e/.out/*.png
@@ -104,10 +104,10 @@ jobs:
           --health-retries 5
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6
         with:
           dotnet-version: 10.0.x
 

@@ -0,0 +1,31 @@
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      # Compare dependency metadata without installing or executing PR code.
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime, development, unknown
+          license-check: false
+          show-openssf-scorecard: false
@@ -3,6 +3,10 @@
 Help ProCoderJii become a useful learning and placement-practice platform for students. Code,
 documentation, accessibility improvements, original questions, and clear bug reports are welcome.
 
+You can open a pull request for a focused bug fix, documentation correction, test improvement,
+or other work within an agreed issue without asking the owner for permission first. Use
+[Support](SUPPORT.md) when you need help choosing the right place for a question or report.
+
 ## Find a useful change
 
 - Read the [project overview](README.md) and [documentation index](docs/README.md).
@@ -13,7 +17,7 @@ documentation, accessibility improvements, original questions, and clear bug rep
   are larger.
 - Check existing [issues](https://github.com/procoderji-com/procoderji/issues) and
   [pull requests](https://github.com/procoderji-com/procoderji/pulls) before starting.
-- Discuss larger features, paid features, data collection, or dependency changes in an issue first.
+- Discuss larger features, paid features, data collection, or new runtime dependencies in an issue first.
   Include the student problem and the smallest useful outcome.
 - Use the practice-question issue form to propose a new exercise. Include the answer,
   explanation, audience, and authorship or source permission.
@@ -22,6 +26,8 @@ documentation, accessibility improvements, original questions, and clear bug rep
 
 An issue being open does not reserve it for anyone. Leave a short comment when you start work so
 contributors can coordinate. Ask for clarification when an acceptance criterion is unclear.
+Small fixes do not need a separate issue. Labels help maintainers organise work; contributors do
+not need to add labels or request a label before submitting an issue or pull request.
 
 ## Set up your fork
 
@@ -66,8 +72,11 @@ branches. Do not force-push over work you have not checked.
 - Keep a pull request about one student problem or contributor improvement.
 - Use TypeScript and the existing UI patterns. Keep practice rules and scoring independent of
   React, storage, authentication, and payment providers.
-- Put new practice-domain work under `src/features/practice/`; read the
+- Put question-practice domain work under `src/features/practice/`; read the
   [boundary decision](docs/decisions/0001-student-product-boundaries.md) before adding adapters.
+- Follow the [games plan](https://github.com/procoderji-com/procoderji/issues/24) and
+  [shared-game foundation](https://github.com/procoderji-com/procoderji/issues/58) for new games.
+  Keep game-result formats separate from the existing multiple-choice progress contract.
 - Add original questions to `shared/practice/questions.json`, the canonical bank consumed by
   both runtimes. Keep the TypeScript and .NET validation behavior consistent when its shape changes.
 - Put authentication, account persistence, and future server-owned capabilities under
@@ -89,23 +98,19 @@ payment or account requirements need an agreed scope and a documented data flow.
 Run the checks relevant to your change; the commands are explained in
 [Development](docs/development.md#checks).
 
-```bash
-npm run lint
-npm run typecheck
-npm test
-npm run build
-```
-
-For backend or shared-question changes, also run:
+| Change | Relevant checks |
+| --- | --- |
+| Documentation only | Review wording, commands and links; runtime tests are unnecessary when behavior is unchanged. |
+| Frontend code | `npm run lint`, `npm run typecheck`, `npm test`, and `npm run build`. |
+| Backend code | `dotnet test backend/ProCoderJi.slnx --configuration Release`; persistence changes also need the affected database contracts described in the backend guide. |
+| Shared questions or portfolio validation rules | Frontend and backend tests, because both runtimes consume the contract. |
+| Routes, metadata, or published learning content | `npm run launch-check`, plus the relevant code or content tests. |
+| Browser interactions | `npm run e2e` with Chrome or Edge installed, plus the relevant code checks. |
 
-```bash
-dotnet test backend/ProCoderJi.slnx --configuration Release
-```
-
-For routes, links, or metadata, also run `npm run launch-check`. For browser interactions, run
-`npm run e2e` with Chrome installed. Browser checks temporarily install synthetic content and
-refuse to run if `src/data` or `src/content` has local changes. For content-only changes, use
-`npm test` and `npm run launch-check` instead.
+Browser checks temporarily install synthetic content and refuse to run if `src/data` or
+`src/content` has local changes. Content authors should use `npm test` and
+`npm run launch-check` while editing those files. List the checks you actually ran and explain
+any that could not run; maintainers and CI complete the remaining validation.
 
 ## Submit the pull request
 
@@ -116,9 +121,14 @@ git push -u origin <your-branch-name>
 ```
 
 Open a pull request from your fork branch to `procoderji-com/procoderji:main`. Fill in the
-template, link the related issue, explain the resulting behavior, and list the checks you ran.
+template, link a related issue when one exists, explain the resulting behavior, and list the
+checks you ran.
 Include screenshots for visible UI changes and sources or permissions for learning content.
 
 Respond to review feedback and keep the branch up to date when needed. Maintainers review
 student value, correctness, accessibility, and maintenance cost before merging. A proposed
 feature may need a smaller scope or further discussion.
+
+The [maintainer guide](docs/maintainer-guide.md) explains routine review, labels, dependency
+updates, and decisions that need the project owner's input. Existing owner decisions remain
+valid; implementing their agreed scope does not need repeated permission.
@@ -55,6 +55,11 @@ Questions are original learning exercises. They are independent of employer asse
 not predict or guarantee hiring outcomes. The first question bank is intentionally small so it
 can be reviewed and improved before expanding.
 
+The expanded [placement-game catalogue](https://github.com/procoderji-com/procoderji/issues/24)
+and [student portfolios](https://github.com/procoderji-com/procoderji/issues/40) are tracked as
+separate work. Check those issues for delivery status; the table above describes the current
+student experience.
+
 ## Progress and optional accounts
 
 Anonymous practice saves the latest **100 completed attempts** in the current browser. The
@@ -68,8 +73,8 @@ each student's own history using PostgreSQL, SQL Server, MongoDB, or local-devel
 See [Backend setup](backend/README.md) and [Docker setup](docs/containers.md)
 for local persistence, Google credentials, and production integration checks.
 
-The hosted product uses [Neon PostgreSQL](docs/neon.md), with separate runtime and migration
-connections.
+[Neon PostgreSQL](docs/neon.md) is the selected hosted database, with separate runtime and
+migration connections. The guide covers configuration and production verification.
 
 The free practice flow works without provider credentials. Paid plans, payment processing, and
 commercial account entitlements require separate product and provider decisions; this repository
@@ -137,6 +142,8 @@ troubleshooting, [backend guide](backend/README.md) for accounts, and
 | Lint, typecheck, tests and build | TypeScript, code quality, domain/store tests, and the production build. |
 | Browser and SEO checks | Desktop/mobile flows, a real .NET process and frontend proxy, the Google sign-in challenge, and a crawl of links/metadata. |
 | Backend build and tests | The .NET solution build and tests for backend rules and access behavior. |
+| Database contracts and container smoke | PostgreSQL, SQL Server and MongoDB contracts, Compose configuration, and the packaged API image. |
+| Dependency review | Pull-request dependency changes checked for newly introduced high or critical vulnerabilities. |
 
 These jobs need no Google credentials or other external secrets. Browser screenshots are
 retained for seven days when the site-quality job fails. A deployed Google sign-in flow still
@@ -154,12 +161,14 @@ src/app/                Next.js routes, metadata, and backend-for-frontend API
 src/features/practice/  Pure practice rules, question-bank adapter, and practice UI
 src/features/progress/  Validated attempt records and browser progress storage
 src/features/account/   Optional account-provider clients and controls
+src/features/portfolio/ Shared-rule validation for portfolio fields and usernames
 src/components/         Shared UI and landing-page sections
 src/content/            Markdown and MDX learning content
 src/data/               Course, guide, and job catalogues
 src/lib/                Existing content, rendering, SEO, and game helpers
-backend/                ASP.NET Core 10 API, EF persistence, and backend tests
+backend/                ASP.NET Core 10 API, persistence adapters, and backend tests
 shared/practice/        Canonical question JSON used by TypeScript and .NET
+shared/portfolio/       Portfolio validation rules and cross-runtime test fixtures
 e2e/                    Browser checks, fixtures, and production crawl
 docs/                   Development, architecture, content, and decision guides
 .github/                CI, Dependabot, issue forms, and pull-request template
@@ -174,6 +183,8 @@ for the boundaries between learning rules, UI, storage, and providers.
 Start with [CONTRIBUTING.md](CONTRIBUTING.md) and the [documentation index](docs/README.md).
 Check open issues before starting a larger feature and describe the student problem it solves.
 Contributors are expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+For setup questions, bug reports and private concerns, follow [Support](SUPPORT.md).
+The [maintainer guide](docs/maintainer-guide.md) explains triage, review and dependency updates.
 
 | Contribution | Start here |
 | --- | --- |
@@ -182,6 +193,7 @@ Contributors are expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
 | Saved progress behavior | [Progress feature](src/features/progress/) and its model/store tests. |
 | Student interface and accessibility | [Practice views](src/features/practice/client/) and shared components. |
 | Optional accounts, synchronization, or persistence | [Backend setup](backend/README.md), [account feature](src/features/account/), and the Next.js `/api/platform/*` proxy. |
+| Portfolio field and username validation | [Shared rules](shared/portfolio/README.md) and the [portfolio roadmap](https://github.com/procoderji-com/procoderji/issues/40). |
 | Original notes, guides, and listings | [Content guide](docs/content-guide.md). |
 | Setup and contributor guidance | `docs/` and the [contribution guide](CONTRIBUTING.md). |
 

@@ -7,12 +7,14 @@ branch.
 
 ## Report a vulnerability
 
-Do not open a public issue for an unpatched vulnerability. Email **procoderji@gmail.com** with
-the affected route or component, the impact, and steps to reproduce. Do not include real user
-data or secrets in the report.
-
-The maintainer will acknowledge the report, investigate it and coordinate a fix before public
-disclosure. There is no bug bounty program at this time.
+Do not open a public issue for an unpatched vulnerability. Use GitHub's
+[private vulnerability report](https://github.com/procoderji-com/procoderji/security/advisories/new)
+to contact the maintainers. If you cannot use GitHub reporting, email **procoderji@gmail.com**.
+Include the affected route or component, the impact, and steps to reproduce. Do not include real
+user data or secrets in the report.
+
+Maintainers investigate reports and coordinate fixes and disclosure with the reporter. Response
+times depend on availability. There is no bug bounty program at this time.
 
 ## Dependency checks
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# Route review requests to the existing project maintainer.
		* @procoder-ji