Open hackathon track · Aug 24, 2026
Trustabl contribution guide
Trustabl is an agent-security scanner. The highest-leverage contribution path is new detection rules — YAML definitions, threat-model docs, and test fixtures across three repos. This page is open to everyone at today's in-person hackathon and anyone contributing remotely.
Monday, August 24 · afternoon
Hult International Business School, 1 Education St, Cambridge, MA
Register on Luma before you arrive — approval is required for campus access.
Register on Luma →Main repositories
- trustabl/trustabl — Core scanner (Go)
- trustabl/trustabl-rules — Detection rule packs (YAML)
- trustabl/trustabl-rulebook — Threat model / rationale docs
Primary contribution path: new rules
Most accessible and highest impact. A single rule lives across three repos.
- YAML definition in trustabl-rules under the correct SDK directory (claude_sdk/, openai_sdk/, google_adk/, mcp/, langchain/, etc.)
- Rationale / threat-model doc in trustabl-rulebook (use the template in docs/policy-rationale-doc-template-guide.md)
- Fire + silent test cases in the engine's testdata/rules-fixture/
Key conventions are documented in trustabl-rules/CLAUDE.md — required fields, ID scheme, severity/confidence guidance, applies_to scopes. After writing the YAML, run trustabl rules validate and the engine's Go tests. trustabl-rules/CLAUDE.md. Rationale template: policy-rationale-doc-template-guide.md.
Other contribution areas
- Engine improvements (Go; CGO required for tree-sitter)
- GitHub Action (trustabl-action)
- Cursor / VS Code extensions
- Documentation and example agent repos
Highest-value target areas right now
- Deeper coverage for LangChain/LangGraph, CrewAI, AutoGen/AG2, Pydantic AI, and Vercel AI SDK (Claude, OpenAI, Google ADK, and MCP currently have the strongest rule sets)
- Completing the missing rationale docs for the 14 shipped MCP rules
- New rules around error handling, idempotency, observability/tracing, approvals, and shell/network safety
- Expanding language support beyond the current Python + TypeScript focus
- Real-world agent templates that surface new failure modes
How to start
- Join the Discord
- Fork the relevant repo(s)
- Open a PR (small, focused PRs preferred)
- For rules, follow the three-repo process above
Happy to support a focused hackathon track around rule authoring + rationale docs. That is the highest-leverage way to contribute in a single session.