# Help and contributing

> Find command help, report problems without private archive data, and locate the source project's contribution and security policies.

Start with the [quickstart](https://www.hansard.dev/getting-started/quickstart/) or
[troubleshooting guide](https://www.hansard.dev/reference/troubleshooting/). Built-in help describes the
commands available in the installed version:

```sh
hansard help
hansard help <command>
hansard doctor
```

The [command reference](https://www.hansard.dev/reference/cli/) groups commands by task. The
[source guides](https://www.hansard.dev/imports/supported-sources/) explain what each importer
can preserve and where its coverage stops.

## Prepare a bug report

1. Record the Hansard version with `hansard --version`.
2. Record the operating system and CPU architecture.
3. Identify the affected agent app or CLI and its version.
4. Write a small reproduction with invented provider data.
5. State the expected result.
6. State the actual result.

Diagnostic output can contain paths, configuration details, and account
identifiers. Review every excerpt before sharing it. Do not attach real
transcripts, raw archives, credentials, session identifiers, or identifying
screenshots. Reconstruct a synthetic example instead of redacting a real one.

## Source project policies

Source distributions include these policies at the repository root:

| File                 | Purpose                                                          |
| -------------------- | ---------------------------------------------------------------- |
| `SUPPORT.md`         | Questions, defects, feature requests, and importer requests.     |
| `CONTRIBUTING.md`    | Development setup, isolated tests, and contribution review.      |
| `SECURITY.md`        | Supported security versions and private vulnerability reporting. |
| `CODE_OF_CONDUCT.md` | Participation expectations and conduct reporting.                |
| `GOVERNANCE.md`      | Project decisions and maintainer responsibilities.               |
| `CITATION.cff`       | Software attribution for research.                               |

These source policies are separate from the npm package. Use the repository's
support channels when available. A suspected vulnerability belongs in private
reporting, never in a public bug report. GitHub documents its
[private vulnerability reporting process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
If the repository has no private reporting button, request that it be enabled
without including vulnerability details.