Skip to content
SecHelixv3 alpha
GitHub
DocsContributeSupportWorkbenchGitHub
Back to overview
Community extension program

Extend the system without weakening the contract.

Build adapters, packs, specialists, reporters, and integrations in public. Authority is declared up front, fixture proof is required, and official status is earned in a separate review.

ForkOwn the implementation
ProvePass contract + fixtures
SubmitCommunity channel first
EarnMaintainer promotion
01

The five-step contribution loop

  1. 01

    Propose the gap

    Open the extension issue and name the users, missing evidence, required authority, and safe boundary.

  2. 02

    Fork + manifest

    Create extensions/community/<id>/extension.json and declare every entrypoint, permission, fixture, and output contract.

  3. 03

    Prove both sides

    Add deterministic positive/negative or vulnerable/clean fixtures. A happy-path demo is not enough.

  4. 04

    Pass the gates

    Run the extension validator and the repository tests. CI checks identity, paths, safe defaults, and registry consistency.

  5. 05

    Submit the PR

    The pull request begins in Community. Incubating and Official are separate maintainer-reviewed decisions.

02

What the manifest makes reviewable

extension.json
{
  "id": "your-extension",
  "lifecycle": "COMMUNITY",
  "permissions": {
    "network": "NONE",
    "filesystem": "READ_SCOPED",
    "subprocess": "NONE",
    "secrets": []
  },
  "safety": {
    "destructive_actions": false,
    "production_mutation": false,
    "evidence_contract": true
  }
}

Contract

Valid v1 manifest, matching registry identity, repository-relative paths.

Authority

Network, filesystem, subprocess, and secret access are fully declared.

Safety

No destructive default and no production mutation.

Evidence

Output targets a canonical contract and preserves provenance.

Fixture proof

Deterministic tests exercise success and rejection paths.

Lifecycle

Contributors cannot self-assign Incubating or Official.

03

Trust channels are not finding confidence

COMMUNITY

Contract-valid submission accepted into the curated registry.

INCUBATING

Promising work under active maintainer calibration and compatibility review.

OFFICIAL

Maintained under the SecHelix release, compatibility, and security process.

These labels describe distribution trust and maintenance. They never replace evidence confidence on a security finding.

Ready to build?

Start with the problem, then make the authority visible.

Propose an extension Read the contract