chore: add contribution governance docs and dotenv dependency

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,52 @@
+---
+name: Bug report
+about: Report a reproducible bug in OpenFrame
+title: "bug: "
+labels: [bug]
+assignees: []
+---
+
+## Bug summary
+
+What went wrong?
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+What should have happened?
+
+## Actual behavior
+
+What happened instead?
+
+## Environment
+
+- OpenFrame version/branch:
+- Bun version:
+- Node version:
+- Browser (if UI issue):
+- OS:
+
+## Relevant logs/errors
+
+```text
+Paste error logs, stack traces, or API errors here.
+```
+
+## Scope and impact
+
+- [ ] Blocking
+- [ ] High
+- [ ] Medium
+- [ ] Low
+
+Who is affected and how?
+
+## Additional context
+
+Screenshots, recordings, or links.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Questions and contribution help
+    url: https://github.com/yusufipk/OpenFrame/blob/main/CONTRIBUTING.md
+    about: Use issues for actionable tasks; for questions, include context and expected outcome.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,45 @@
+---
+name: Feature request
+about: Suggest an improvement for OpenFrame
+title: "feat: "
+labels: [enhancement]
+assignees: []
+---
+
+## Problem statement
+
+What problem are you trying to solve?
+
+## Proposed solution
+
+What do you want to happen?
+
+## Alternatives considered
+
+What alternatives did you evaluate?
+
+## Scope
+
+Which areas are affected?
+
+- [ ] API
+- [ ] Auth/access
+- [ ] Database
+- [ ] UI/UX
+- [ ] Docs
+- [ ] DevEx/Operations
+
+## Acceptance criteria
+
+How will we know this is done?
+
+- [ ] Criterion 1
+- [ ] Criterion 2
+
+## Non-goals (optional)
+
+What is explicitly out of scope?
+
+## Additional context
+
+Mockups, examples, or references.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,62 @@
+## Summary
+
+Explain what changed in this PR.
+
+## Why
+
+Explain the problem this PR solves.
+
+## Type of change
+
+- [ ] feat
+- [ ] fix
+- [ ] docs
+- [ ] refactor
+- [ ] chore
+- [ ] test
+
+## Scope
+
+What areas are affected?
+
+- [ ] API routes
+- [ ] Auth / access control
+- [ ] Database schema / migration
+- [ ] UI / UX
+- [ ] Documentation
+- [ ] Other
+
+## Validation
+
+- [ ] I ran `bun run check`.
+- [ ] I ran `bun run db:generate` if `prisma/schema.prisma` changed.
+- [ ] I manually tested affected flows.
+
+Validation notes:
+
+```text
+Paste command output or manual test notes here.
+```
+
+## Breaking changes
+
+- [ ] No breaking changes
+- [ ] This PR introduces a breaking change (describe below)
+
+If breaking, explain migration path:
+
+## Database / migration notes
+
+If schema changed, summarize migration impact.
+
+## Screenshots / examples (if relevant)
+
+Add screenshots or API request/response examples.
+
+## Checklist
+
+- [ ] PR title follows Conventional Commits (`type(scope): summary`).
+- [ ] I used `successResponse` / `apiErrors` for API response changes.
+- [ ] I used `auth()` and shared access checks (`checkProjectAccess` / `checkWorkspaceAccess`) where relevant.
+- [ ] I updated docs when behavior changed.
+- [ ] No secrets or unrelated file changes are included.

CODEOWNERS

@@ -0,0 +1,10 @@
+# Global default owners
+* @yusufipk
+
+# Critical security and access control areas
+
+/lib/auth.ts @yusufipk
+/lib/route-access.ts @yusufipk
+/app/api/auth/ @yusufipk
+/app/api/stripe/ @yusufipk
+/prisma/ @yusufipk

CODE_OF_CONDUCT.md

@@ -0,0 +1,80 @@
+# Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Taking responsibility, apologizing to those affected by mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to behavior they deem inappropriate, threatening, offensive, or harmful.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces and also applies when an individual is officially representing the project in public spaces. Examples include using an official project email address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+If you experience or witness unacceptable behavior, report it by opening a private security advisory at:
+
+- https://github.com/yusufipk/OpenFrame/security/advisories/new
+
+Reports will be reviewed and investigated promptly and fairly.
+All maintainers are obligated to respect the privacy and security of the reporter.
+
+## Enforcement Guidelines
+
+Maintainers will follow these Community Impact Guidelines in determining consequences:
+
+### 1. Correction
+
+Community Impact: Use of inappropriate language or other behavior deemed unprofessional or unwelcome.
+
+Consequence: A private, written warning from maintainers, providing clarity around the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+Community Impact: A violation through a single incident or series of actions.
+
+Consequence: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction, for a specified period. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+Community Impact: A serious violation of community standards, including sustained inappropriate behavior.
+
+Consequence: A temporary ban from any interaction or public communication with the community for a specified period. No public or private interaction with the people involved is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+Community Impact: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+Consequence: A permanent ban from any sort of public interaction within the project community.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 2.1:
+
+- https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+
+Community Impact Guidelines were inspired by Mozilla's code of conduct enforcement ladder.

CONTRIBUTING.md

@@ -0,0 +1,244 @@
+# Contributing to OpenFrame
+
+Thanks for taking the time to contribute to OpenFrame.
+This guide explains where contributions are most useful, how to prepare a pull request, and which project conventions are required.
+
+## Ways to Contribute
+
+You can contribute in several ways:
+
+- Fix bugs in existing behavior.
+- Improve reliability, safety, and performance.
+- Build features that align with product goals.
+- Improve documentation in [README.md](README.md) and related in-repo docs.
+- Add tests and increase confidence for risky paths.
+
+## What To Work On
+
+Good places to contribute:
+
+- API routes in [app/api](app/api)
+- Auth and access control in [lib/auth.ts](lib/auth.ts) and [lib/route-access.ts](lib/route-access.ts)
+- API response consistency in [lib/api-response.ts](lib/api-response.ts)
+- Data model and migrations in [prisma/schema.prisma](prisma/schema.prisma) and [prisma/migrations](prisma/migrations)
+- Video review UI in [components/video-page](components/video-page)
+- Operational and setup docs in [README.md](README.md)
+
+If your change is large, open an issue first so scope can be aligned.
+
+## Local Setup
+
+1. Install dependencies:
+
+```bash
+bun install
+```
+
+2. Copy environment file and set required values:
+
+```bash
+cp .env.example .env
+```
+
+3. Ensure Prisma client is generated:
+
+```bash
+bun run db:generate
+```
+
+4. Run validation:
+
+```bash
+bun run check
+```
+
+Optional helpful commands:
+
+```bash
+bun run db:push
+bun run db:migrate
+bun run db:seed
+```
+
+## Contribution Workflow
+
+1. Fork and create a branch from `main`.
+2. Keep changes focused on one logical concern.
+3. Follow coding and architecture conventions in this guide.
+4. Run required validation locally.
+5. Open a PR with a clear description and checklist.
+
+## Branch Naming
+
+Use one of these prefixes:
+
+- `feature/<short-topic>`
+- `fix/<short-topic>`
+- `docs/<short-topic>`
+- `refactor/<short-topic>`
+- `chore/<short-topic>`
+
+Examples:
+
+- `feature/approval-request-filters`
+- `fix/share-link-password-validation`
+- `docs/contributing-guide`
+
+## Commit and PR Title Standard
+
+Use Conventional Commits style:
+
+- `feat: add workspace invite resend endpoint`
+- `fix: prevent guest comment without share permission`
+- `docs: add contribution workflow examples`
+- `refactor: simplify project access checks`
+
+Recommended pattern:
+
+```text
+type(scope): short summary
+```
+
+Examples:
+
+- `feat(api): add comment export pagination`
+- `fix(auth): block unverified credential sign-in`
+
+## Required Checks Before Opening a PR
+
+You should run:
+
+```bash
+bun run check
+```
+
+If you changed [prisma/schema.prisma](prisma/schema.prisma), also run:
+
+```bash
+bun run db:generate
+```
+
+Also verify:
+
+- No unrelated file changes are included.
+- No secrets or private keys are committed.
+- Docs are updated when behavior changes.
+
+## Project Conventions (Must Follow)
+
+### Package and scripts
+
+- Use Bun commands only for dependency and script workflows.
+- Keep lockfile changes intentional and minimal.
+
+### Auth and authorization
+
+- Server-side session reads: use `auth()` from [lib/auth.ts](lib/auth.ts).
+- Access checks: use `checkProjectAccess()` / `checkWorkspaceAccess()`.
+- Do not implement ad-hoc role checks when shared helpers exist.
+
+### API responses
+
+- Use `successResponse` / `apiErrors` from [lib/api-response.ts](lib/api-response.ts).
+- Keep error messages specific but safe.
+
+### Dynamic route params
+
+In App Router dynamic routes, keep `params` typed as `Promise<...>` and use `await params`.
+
+### Database write safety
+
+- For multi-step DB writes, use Prisma transactions.
+- Prefer backward-compatible API changes unless a breaking change is explicitly required.
+- If custom SQL is needed, manage it in migration SQL files under [prisma/migrations](prisma/migrations).
+
+### Imports
+
+- Prefer `@/` alias imports when available.
+
+## Database Change Guidelines
+
+When changing data model behavior:
+
+1. Update [prisma/schema.prisma](prisma/schema.prisma).
+2. Generate Prisma client (`bun run db:generate`).
+3. Add/update migration files as needed under [prisma/migrations](prisma/migrations).
+4. Validate affected endpoints and access-control paths.
+5. Include migration notes in the PR description.
+
+## Frontend Change Guidelines
+
+- Preserve existing UI patterns and information architecture.
+- Keep components focused; extract reusable logic into hooks/services.
+- Avoid unrelated visual churn in functional PRs.
+- Ensure desktop and mobile behavior remains usable.
+
+## Documentation Change Guidelines
+
+- Primary project docs: [README.md](README.md)
+- For technical changes, document behavior in the most relevant existing file or PR notes.
+- Keep docs practical and update them in the same PR when behavior changes.
+
+## Pull Request Checklist
+
+Before submitting, confirm:
+
+- [ ] My branch is focused on one concern.
+- [ ] I followed project conventions in this guide.
+- [ ] I ran `bun run check`.
+- [ ] I ran `bun run db:generate` if schema changed.
+- [ ] I updated docs for user-visible or architectural changes.
+- [ ] I added screenshots or request/response examples when useful.
+- [ ] My PR description explains what changed and why.
+
+## PR Description Template (Recommended)
+
+```markdown
+## Summary
+
+Short description of what changed.
+
+## Why
+
+What problem this solves.
+
+## Changes
+
+- Key change 1
+- Key change 2
+
+## Validation
+
+- bun run check
+- Manual test notes
+
+## Notes
+
+Any migration, compatibility, or follow-up notes.
+```
+
+## Review Expectations
+
+Maintainers will usually review for:
+
+- Correctness and regressions
+- Security and access control
+- API contract compatibility
+- Code clarity and maintainability
+- Operational safety (migrations, cleanup impact)
+
+Please be responsive to review comments and keep follow-up commits scoped.
+
+## Security Issues
+
+Do not open public issues for security vulnerabilities.
+Please follow [SECURITY.md](SECURITY.md).
+
+## Code of Conduct
+
+Please follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
+
+## Need Help?
+
+If you are unsure where to start, open an issue with context and a proposed approach.
+Maintainers can help you scope the change before implementation.

README.md

@@ -151,3 +151,11 @@ bun run check
 ```
 
 Feature flags and self-hosting environment variables are documented in `.env.example` and `.env.docker.example`.
+
+## Contributing
+
+Contributions are welcome.
+
+- Read [CONTRIBUTING.md](CONTRIBUTING.md) for workflow, conventions, and PR requirements.
+- Use [SECURITY.md](SECURITY.md) for responsible vulnerability reporting.
+- Follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) in all project interactions.

bun.lock

@@ -13,10 +13,11 @@
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "date-fns": "^4.1.0",
+        "dotenv": "^17.4.2",
         "gsap": "^3.14.2",
         "hls.js": "^1.6.15",
         "lucide-react": "^0.563.0",
-        "next": "^16.2.3",
+        "next": "16.2.3",
         "next-auth": "^5.0.0-beta.30",
         "next-themes": "^0.4.6",
         "nodemailer": "^8.0.5",
@@ -948,7 +949,7 @@
 
     "doctrine": ["[email protected]", "", { "dependencies": { "esutils": "^2.0.2" } }, "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw=="],
 
-    "dotenv": ["dotenv@17.2.3", "", {}, "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w=="],
+    "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
 
     "dunder-proto": ["[email protected]", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
@@ -1904,6 +1905,8 @@
 
     "@dotenvx/dotenvx/commander": ["[email protected]", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
 
+    "@dotenvx/dotenvx/dotenv": ["[email protected]", "", {}, "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w=="],
+
     "@dotenvx/dotenvx/execa": ["[email protected]", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
 
     "@dotenvx/dotenvx/which": ["[email protected]", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg=="],

package.json

@@ -32,6 +32,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
+    "dotenv": "^17.4.2",
     "gsap": "^3.14.2",
     "hls.js": "^1.6.15",
     "lucide-react": "^0.563.0",