doc: contributing & security (#21)

* doc: contributing & security

* fix

* nope

* nope

* tagline & getting started

* fix review

.github/workflows/benchmark.yaml

@@ -49,5 +49,5 @@ jobs:
       - name: Run the benchmarks
         uses: CodSpeedHQ/action@v3
         with:
-          run: cargo codspeed run && pnpm -C ./packages/benchmark-wasm run benchmark-codspeed && pnpm -C ./packages/language-server-tests-benchmarks run benchmark-codspeed
+          run: cargo codspeed run && pnpm -C ./packages/benchmark-wasm run benchmark-codspeed && pnpm -C ./packages/ls-tests-benchmarks run benchmark-codspeed
           token: ${{ secrets.CODSPEED_TOKEN }}

CONTRIBUTING.md

@@ -0,0 +1,25 @@
+# Contributing to Our Open Source Projects
+
+First, a huge **thank you** for dedicating your time to helping us improve our projects 🧡
+
+## Before Opening Issues
+
+- **Do not report security vulnerabilities publicly** (e.g., in issues or discussions), please refer to our [security policy](https://github.com/web-lsp/weblsp/blob/main/SECURITY.md).
+- **Do not create issues for ideas or suggestions.** Instead, share your thoughts in our [GitHub Discussions](https://github.com/web-lsp/weblsp/discussions/categories/ideas).
+- **Do not create issues for questions.** Instead, ask your question in our [GitHub Discussions](https://github.com/web-lsp/weblsp/discussions/categories/q-a).
+- **Check for duplicates.** Look through existing issues and discussions to see if your topic has already been addressed.
+- Provide as much detail as possible. However, don’t worry if it’s incomplete—we will help refine it!
+
+## Before submitting Pull Requests (PRs)
+
+- **Check for duplicates.** Look through existing PRs to see if your changes have already been submitted.
+- **Avoid trivial changes.** Don't submit PRs for typos, grammar, or insignificant changes, as they will be **declined** without review.
+- PRs don't need to be perfect. Submit your best effort, and we will gladly assist in polishing the work.
+
+## Code of Conduct
+
+We’re committed to fostering a welcoming and respectful community. Any issue, PR, or discussion that violates our [code of conduct](https://github.com/web-lsp/weblsp/blob/main/CODE_OF_CONDUCT.md) will be deleted, and the authors will be **banned**.
+
+---
+
+Thank you once again for contributing, we deeply appreciate all contributions, no matter how small or big.

README.md

@@ -1,27 +1,60 @@
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="./.github/assets/WEBlsp_logo_dark.svg" />
-  <img alt="WEBlsp logo" src="./.github/assets/WEBlsp_logo_light.svg" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_dark.svg" />
+  <img alt="WEBlsp logo" src="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_light.svg" />
 </picture>
 
-A better Language Server for the Web, made with Rust.
+A language server for the Web.
 
-(Work In Progress) ~~It provides full-featured language support for HTML and CSS, including syntax highlighting, code completion, error checking, and more.~~ Compliant with the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), WEBlsp is designed to work with any IDE that supports LSP. Build on top of ~~HTMLlsrs~~ and [CSSlsrs](https://github.com/web-lsp/csslsrs), our own modern, fast, and reliable Language Services.
+WEBlsp is an implementation of the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/) (Work In Progress) ~~providing full-featured language support for HTML and CSS, including code completion, diagnostics, hover, and more.~~ It uses ~~HTMLlsrs~~ and [CSSlsrs](https://github.com/web-lsp/weblsp/tree/main/crates/csslsrs), our own modern and fast language services, designed to be integrated into language servers written in Rust or via WebAssembly.
 
-## Crates
+## Quick Links
+
+🐛 [Report a bug](https://github.com/web-lsp/weblsp/issues), please read our [contributing guidelines](https://github.com/web-lsp/weblsp/blob/main/CONTRIBUTING.md) and [code of conduct](https://github.com/web-lsp/weblsp/blob/main/CODE_OF_CONDUCT.md) first.
+
+🚨 [Report a security vulnerability](https://github.com/web-lsp/weblsp/security/advisories/new), and be sure to review our [security policy](https://github.com/web-lsp/weblsp/blob/main/SECURITY.md).
+
+💬 [Join the discussion](https://github.com/web-lsp/weblsp/discussions), if you have any questions, ideas, or suggestions.
+
+## Development
+
+### Getting Started
+
+To get started with WEBlsp, you will need to install the following tools:
+
+- [Rust](https://www.rust-lang.org/tools/install)
+- [Node.js](https://nodejs.org/en/download/)
+- [PNPM](https://pnpm.io/installation)
+- [Just](https://just.systems/)
+- [wasm-bindgen-cli](https://rustwasm.github.io/wasm-bindgen/) (optional, for building WASM binaries)
+- [wasm-opt](https://github.com/WebAssembly/binaryen) (optional, for WASM benchmarks and releases)
+
+Useful commands:
+
+| Command           | Description                                             |
+| ----------------- | ------------------------------------------------------- |
+| `just install`    | Install NPM dependencies across all crates and packages |
+| `just build`      | Build WEBlsp crate and every language services          |
+| `just build-wasm` | Build WASM packages                                     |
+| `just test`       | Run tests for all crates and packages                   |
+| `just benchmark`  | Run native, WASM, and E2E benchmarks                    |
+
+### Crates
 
 WEBlsp is a monorepo that contains the following crates (Rust packages):
 
 | Name      | Description              | Crates.io | README                                  |
 | --------- | ------------------------ | --------- | --------------------------------------- |
-| `weblsp`  | The main Language Server | WIP       | [README.md](./crates/weblsp/README.md)  |
-| `csslsrs` | CSS Language Service     | WIP       | [README.md](./crates/csslsrs/README.md) |
+| `weblsp`  | The main language server | WIP       | [README.md](./crates/weblsp/README.md)  |
+| `csslsrs` | CSS language service     | WIP       | [README.md](./crates/csslsrs/README.md) |
 
-## Packages
+### Packages
 
 Additionally, WEBlsp contains the following NPM packages (JavaScript packages):
 
-| Name             | Description               | NPM | README                                           |
-| ---------------- | ------------------------- | --- | ------------------------------------------------ |
-| `vscode`         | WEBlsp VSCode extension   | WIP | [README.md](./packages/vscode/README.md)         |
-| `csslsrs`        | WASM CSS Language Service | WIP | [README.md](./packages/csslsrs/README.md)        |
-| `benchmark-wasm` | Benchmark WASM packages   | WIP | [README.md](./packages/benchmark-wasm/README.md) |
+| Name                  | Description                                | NPM | README                                                |
+| --------------------- | ------------------------------------------ | --- | ----------------------------------------------------- |
+| `vscode`              | WEBlsp VSCode extension                    | WIP | [README.md](./packages/vscode/README.md)              |
+| `csslsrs`             | CSSlsrs API for JS/TS                      | WIP | [README.md](./packages/csslsrs/README.md)             |
+| `benchmark-wasm`      | Benchmark WASM packages                    | WIP | [README.md](./packages/benchmark-wasm/README.md)      |
+| `ls-tests-benchmarks` | End-to-end tests and benchmarks for WEBlsp | WIP | [README.md](./packages/ls-tests-benchmarks/README.md) |
+

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions of our projects are currently supported with security updates:
+
+| Package | Version | Supported          |
+| ------- | ------- | ------------------ |
+| WEBlsp  | 0.x.x   | :white_check_mark: |
+| CSSlsrs | 0.x.x   | :white_check_mark: |
+
+## What is a Security Vulnerability?
+
+A security vulnerability is a flaw or weakness in a system's design, implementation, operation, or management that could be exploited to violate the system's security policy. (Source: OWASP)
+
+Please note that we will not accept reports related to vulnerabilities in other software, such as the IDEs that use our server or our dependencies. Additionally, we reserve the right to close reports that describe scenarios deemed highly unlikely or far-fetched.
+
+## Reporting a Vulnerability
+
+We take security issues very seriously. If you discover a vulnerability, please report it through our private reporting form: [Report a Security Vulnerability](https://github.com/web-lsp/weblsp/security/advisories/new).
+
+### Guidelines for Reporting
+
+- Do **not** report vulnerabilities publicly via issues or discussions.
+- Please provide as much detail as possible about the vulnerability to help us investigate and resolve it quickly.
+
+### What to Expect
+
+- You will receive an acknowledgement of your report within **48 hours** (working days).
+- If the report is valid, in most cases, a fix will be published within **one week** of confirming the vulnerability.
+
+Keep in mind that we are an open-source project, and our team is composed of volunteers. We will do our best to address the issue promptly, but we appreciate your understanding and patience.
+
+### Post-Fix Communication
+
+Once the fix is deployed, a **public security advisory** will be published here: [Security Advisories](https://github.com/web-lsp/weblsp/security/advisories). If applicable, credit will be given to the reporter for their responsible disclosure.
+
+We greatly appreciate your efforts to help us maintain the security of our projects.

crates/csslsrs/README.md

@@ -1,11 +1,21 @@
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="../../.github/assets/CSSlsrs_logo_dark.svg" />
-  <img alt="CSSlsrs logo" src="../../.github/assets/CSSlsrs_logo_light.svg" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/CSSlsrs_logo_dark.svg" />
+  <img alt="WEBlsp logo" src="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/CSSlsrs_logo_light.svg" />
 </picture>
 
-A CSS Language Service made with Rust.
+A language service for CSS.
 
-(Work In Progress) ~~It provides full-featured language support for CSS, including syntax highlighting, code completion, error checking, and more.~~ Compliant with the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), CSSlsrs can be integrated into Language Servers written in Rust or JavaScript (via WebAssembly). Thanks to [Biome](https://biomejs.dev/)'s parser, we deliver a fast and efficient language service, designed to improve your productivity when working with CSS.
+(Work In Progress) ~~It provides full-featured language support, including code completion, diagnostics, hover, and more.~~ Compliant with the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), CSSlsrs can be integrated into language servers written in Rust or via WebAssembly. We use [Biome](https://biomejs.dev/)'s CSS parser behind the scenes.
+
+## Quick Links
+
+📖 [Main repository](https://github.com/web-lsp/weblsp/), with all related crates and packages.
+
+🐛 [Report a bug](https://github.com/web-lsp/weblsp/issues), please read our [contributing guidelines](https://github.com/web-lsp/weblsp/blob/main/CONTRIBUTING.md) and [code of conduct](https://github.com/web-lsp/weblsp/blob/main/CODE_OF_CONDUCT.md) first.
+
+🚨 [Report a security vulnerability](https://github.com/web-lsp/weblsp/security/advisories/new), and be sure to review our [security policy](https://github.com/web-lsp/weblsp/blob/main/SECURITY.md).
+
+💬 [Join the discussion](https://github.com/web-lsp/weblsp/discussions), if you have any questions, ideas, or suggestions.
 
 ## Features
 

crates/csslsrs/src/service.rs

@@ -7,7 +7,7 @@ use crate::{
 use lsp_types::{TextDocumentItem, Uri};
 use serde::{Deserialize, Serialize};
 
-/// The Language Service is the main entry point for interacting with CSSlsrs.
+/// The language service is the main entry point for interacting with CSSlsrs.
 /// It contains a DocumentStore, a PositionEncoding and a reference to the CSS data.
 pub struct LanguageService {
     pub(crate) store: DocumentStore,

crates/weblsp/README.md

@@ -1,21 +1,18 @@
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="../../.github/assets/WEBlsp_logo_dark.svg" />
-  <img alt="WEBlsp logo" src=".../../.github/assets/WEBlsp_logo_light.svg" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_dark.svg" />
+  <img alt="WEBlsp logo" src="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_light.svg" />
 </picture>
 
-A better Language Server for the Web, made with Rust.
+A language server for the Web.
 
-(Work In Progress) ~~It provides full-featured language support for HTML and CSS, including syntax highlighting, code completion, error checking, and more.~~ Compliant with the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), WEBlsp is designed to work with any IDE that supports LSP. Build on top of ~~HTMLlsrs~~ and [CSSlsrs](https://github.com/web-lsp/csslsrs), our own modern, fast, and reliable Language Services.
+WEBlsp is an implementation of the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), using ~~HTMLlsrs~~ and [CSSlsrs](https://github.com/web-lsp/weblsp/tree/main/crates/csslsrs) behind the scenes. (Work In Progress) ~~It provides full-featured language support for HTML and CSS, including code completion, diagnostics, hover, and more.~~ 
 
-## TODO
+## Quick Links
 
-- [x] LSP basic server
-- [ ] Handle request by language (HTML, CSS)
-- [x] CSS Language Service (CSSlsrs) integration
-- [ ] HTML Language Service (HTMLlsrs) integration
-- [ ] Publish VSCode extension
+📖 [Main repository](https://github.com/web-lsp/weblsp/), with all related crates and packages.
 
-## Useful commands
+🐛 [Report a bug](https://github.com/web-lsp/weblsp/issues), please read our [contributing guidelines](https://github.com/web-lsp/weblsp/blob/main/CONTRIBUTING.md) and [code of conduct](https://github.com/web-lsp/weblsp/blob/main/CODE_OF_CONDUCT.md) first.
 
-- `cargo build` - Build the project
-- `cd ./packages/vscode && pnpm run compile` - Compile the vscode extension
+🚨 [Report a security vulnerability](https://github.com/web-lsp/weblsp/security/advisories/new), and be sure to review our [security policy](https://github.com/web-lsp/weblsp/blob/main/SECURITY.md).
+
+💬 [Join the discussion](https://github.com/web-lsp/weblsp/discussions), if you have any questions, ideas, or suggestions.

crates/weblsp/src/css.rs

@@ -8,14 +8,14 @@ use std::error::Error;
 
 use crate::requests::cast;
 
-/// Initialize our CSS Language Service (CSSlsrs).
+/// Initialize our CSS language service (CSSlsrs).
 /// Used once at the start of the main loop, so the document store stays alive throughout the server's lifetime.
 pub fn init_language_service() -> LanguageService {
     LanguageService::default()
 }
 
 /// Handle WEBlsp's CSS requests. This function will be called by the main loop when a CSS request is received,
-/// and will dispatch the request to our CSS Language Service (CSSlsrs).
+/// and will dispatch the request to our CSS language service (CSSlsrs).
 pub fn handle_request(
     language_service: &mut LanguageService,
     connection: &Connection,

crates/weblsp/src/notifications.rs

@@ -17,7 +17,7 @@ pub fn handle_notification(
         }
         "textDocument/didOpen" => {
             // didOpen notification carry a textDocument item, which contains the document's URI and languageId.
-            // We can use this information to determine in which Language Service's store we should add the document.
+            // We can use this information to determine in which language service's store we should add the document.
             let params: DidOpenTextDocumentParams =
                 serde_json::from_value(notification.params).unwrap();
             match params.text_document.language_id.as_str() {

justfile

@@ -33,5 +33,5 @@ benchmark:
 	cargo bench
 	echo "Running WASM benchmarks..."
 	pnpm -C ./packages/benchmark-wasm run benchmark --run
-	echo "Running Language Server benchmarks..."
-	pnpm -C ./packages/language-server-tests-benchmarks run benchmark --run
+	echo "Running language server benchmarks..."
+	pnpm -C ./packages/ls-tests-benchmarks run benchmark --run

packages/benchmark-wasm/README.md

@@ -1,6 +1,6 @@
-# benchmark-wasm
+# @web-lsp/benchmark-wasm
 
-This package contains benchmarks for the WASM output of CSSLSRS, comparing it with other popular language services for CSS in JavaScript.
+This private package contains benchmarks for the WASM output of CSSLSRS, comparing it with other popular language services for CSS in JavaScript.
 
 ## Adding a new benchmark
 

packages/benchmark-wasm/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "benchmark-wasm",
+  "name": "@weblsp/benchmark-wasm",
   "version": "0.0.1",
   "private": true,
   "type": "module",

packages/csslsrs/README.md

@@ -1,3 +1,18 @@
-# CSSlsrs - WASM CSS Language Service 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/CSSlsrs_logo_dark.svg" />
+  <img alt="WEBlsp logo" src="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/CSSlsrs_logo_light.svg" />
+</picture>
 
-Work in progress.
+A language service for CSS.
+
+(Work In Progress) ~~It provides full-featured language support for HTML and CSS, including code completion, diagnostics, hover, and more.~~ Compliant with the [Language Server Protocol](https://microsoft.github.io/language-server-protocol/), this package contains JavaScript/TypeScript API for [CSSlsrs](https://github.com/web-lsp/weblsp/tree/main/crates/csslsrs) WASM exports.
+
+## Quick Links
+
+📖 [Main repository](https://github.com/web-lsp/weblsp/), with all related crates and packages.
+
+🐛 [Report a bug](https://github.com/web-lsp/weblsp/issues), please read our [contributing guidelines](https://github.com/web-lsp/weblsp/blob/main/CONTRIBUTING.md) and [code of conduct](https://github.com/web-lsp/weblsp/blob/main/CODE_OF_CONDUCT.md) first.
+
+🚨 [Report a security vulnerability](https://github.com/web-lsp/weblsp/security/advisories/new), and be sure to review our [security policy](https://github.com/web-lsp/weblsp/blob/main/SECURITY.md).
+
+💬 [Join the discussion](https://github.com/web-lsp/weblsp/discussions), if you have any questions, ideas, or suggestions.

packages/csslsrs/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "csslsrs",
+  "name": "@weblsp/csslsrs",
   "version": "0.1.1",
   "type": "module",
   "description": "",

packages/language-server-tests-benchmarks/README.md → packages/ls-tests-benchmarks/README.md

@@ -1,6 +1,10 @@
-# language-server-tests-benchmarks
+# @weblsp/ls-tests-benchmarks
 
-The tests and benchmarks in this folder aims to test and benchmark the language server in a close-to-reality scenario, using the same JavaScript client powered by `vscode-jsonrpc` used in VS Code.
+This private package aims to test and benchmark the language server in a close-to-reality scenario, using the same JavaScript client powered by `vscode-jsonrpc` used in VS Code.
+
+## Running the tests
+
+WIP.
 
 ## Why are the benchmarks so slow?
 

packages/language-server-tests-benchmarks/package.json → packages/ls-tests-benchmarks/package.json

@@ -1,5 +1,5 @@
 {
-	"name": "language-server-tests-benchmarks",
+	"name": "@weblsp/ls-tests-benchmarks",
 	"type": "module",
 	"private": true,
 	"scripts": {

packages/vscode/README.md

@@ -1,3 +1,8 @@
-# WEBlsp's vscode extension
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_dark.svg" />
+  <img alt="WEBlsp logo" src="https://raw.githubusercontent.com/web-lsp/weblsp/refs/heads/main/.github/assets/WEBlsp_logo_light.svg" />
+</picture>
 
-Work In Progress.
+A language server for the Web, now in VSCode.
+
+(Work In Progress) ~~It provides full-featured language support for HTML and CSS, including code completion, diagnostics, hover, and more.~~

packages/vscode/package.json

@@ -2,7 +2,7 @@
 	"name": "@weblsp/vscode",
 	"displayName": "WEBlsp",
 	"version": "1.0.0",
-	"description": "A better Language Server for the Web, made with Rust — WORK IN PROGRESS ⚠️",
+	"description": "A language server for the Web — WORK IN PROGRESS ⚠️",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/web-lsp/weblsp"