# Contributing

Ways to contribute to erxes: code, docs, issues, security reports, and licensing notes


erxes accepts code, documentation, tests, translations, bug reports, and security reports.

## Ways to contribute

| Contribution | Where it goes | Start here |
| --- | --- | --- |
| Bug report or feature request | [GitHub Issues](https://github.com/erxes/erxes/issues) | Search first. Include the erxes version (root `package.json` `version`), the affected plugin, reproduction steps, and expected vs. actual behavior. |
| Code: fix, feature, or plugin | Pull request to `erxes/erxes` | Finish [Local Setup](https://erxes.io/docs/local-setup) first, then [Contribute to codebase](https://erxes.io/docs/contribute-codebase) for the workflow, [Code Standards](https://erxes.io/docs/contribute-standards), and [Testing](https://erxes.io/docs/contribute-testing). New plugins start with `pnpm create-plugin`; see [Create a Plugin](https://erxes.io/docs/create-plugin). |
| Documentation | `erxes/erxes-global-profile`, `markdown/*.mdx` | See [How the public docs are maintained](#how-the-public-docs-are-maintained). |
| Translations | `backend/gateway/src/locales/<lng>/<namespace>.json`, or a plugin's own `src/locales` (for example [`frontline_api/src/locales`](https://github.com/erxes/erxes/tree/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/backend/plugins/frontline_api/src/locales)) | The gateway serves these files at `/locales/:lng/:file`, falling back to files fetched from plugin services, and `core-ui` loads them with `i18next-http-backend` ([config](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/frontend/core-ui/src/i18n/config.ts)). Supported languages are `en` and `mn`. `CONTRIBUTING.md` points existing translation work to [Transifex](https://explore.transifex.com/erxes-inc/erxesxos/). |
| Questions | [Discord](https://discord.com/invite/aaGzy3gQK5) or a GitHub issue | Ask before you introduce a new pattern. |

The repository has no issue or pull request templates: `.github/` contains only `workflows/`. The conventions above come from [`CONTRIBUTING.md`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/CONTRIBUTING.md), not from a form. Issues labeled `bug` or `sentry` are forwarded to an internal listener by [`auto-issue-webhook.yml`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/.github/workflows/auto-issue-webhook.yml), so label bug reports accurately.

[`HACKTOBERFEST.md`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/HACKTOBERFEST.md) is a welcome note for Hacktoberfest 2025. It repeats the branch prefixes (`fix/`, `docs/`, `feat/`) and asks for quality over quantity; it adds no separate process.

## Code of conduct

[`CODE_OF_CONDUCT.md`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/CODE_OF_CONDUCT.md) is the Contributor Covenant 1.4. It applies in project spaces and wherever you represent the project. Report abusive behavior to `info@erxes.io`; maintainers may remove contributions or ban contributors who violate it.

## Report a security vulnerability

> [!WARNING]
> **Do not open a public issue for a vulnerability**
>
> Email `info@erxes.io` with a description, the steps you took, affected versions, and known mitigations. [`SECURITY.md`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/SECURITY.md) states a 90-day disclosure timeline. The repository has no private advisory form beyond this email.

## License implications for contributors

- [`LICENSE.md`](https://github.com/erxes/erxes/blob/f91e8c6f4714c910a32c6b6e14fe085f6435c89e/LICENSE.md) places everything under **AGPLv3** except plugins whose name ends in `-ee` under an `ee/` directory (Enterprise Edition, governed by `ee/LICENSE`; see https://erxes.io/pricing/enterprise-edition) and third-party components under their own licenses.
- `LICENSE.md` also states that erxes may not be hosted as a SaaS product that competes with erxes Inc.
- The root `package.json` declares `"license": "MIT"`. This contradicts `LICENSE.md` and the AGPLv3 badge in `README.md`; treat `LICENSE.md` as the governing text and ask maintainers if the distinction matters for your use.
- There is no CLA or DCO file. Unless a maintainer states otherwise, your pull request is contributed under the repository license.

## How the public docs are maintained

The pages on this site are MDX files in [erxes/erxes-global-profile](https://github.com/erxes/erxes-global-profile) under `markdown/`, one file per slug. A page is published only when it is registered in `constants/docs.ts` and imported in `markdown/registry.ts`; adding a file alone does nothing. When you edit a page, check every path, command, and operation name against the code it links.

## Guides

- [Contribute to codebase](https://erxes.io/docs/contribute-codebase): Fork, branch, validate with Nx, and open a pull request against erxes/erxes
- [Code Standards](https://erxes.io/docs/contribute-standards): Boundaries, types, and UI rules
- [Testing](https://erxes.io/docs/contribute-testing): Project targets and manual flows
- [Releases](https://erxes.io/docs/contribute-releases): Versions and image promotion