Thanks for helping build a practical, security-focused CRA resource.
- Real and reachable only. Every link must resolve and point to a resource a practitioner can actually use. No dead links, no placeholder pages.
- Engineering over commentary. Prefer primary sources, standards, and tooling over opinion pieces. Legal commentary is included only when it clarifies scope or obligations.
- No filler. One strong entry beats five weak ones. Marketing pages and vendor landing pages without substance are rejected.
- Neutral descriptions. One line, factual, no hype.
- Fork the repo.
- Add your entry under the most relevant section, alphabetically where sections are unordered.
- Format:
- [Name](https://url) - short factual description ending with a period. - Run the link check locally if possible.
- Open a pull request describing what you added and why it belongs.
- Broken or redirect-farm links.
- Duplicate resources already covered.
- Generic "top 10 compliance tips" content with no primary-source or tooling value.
- Anything paywalled without a usable free portion.
For changes to tools in tools/, include a short description of the observable behavior change and, where relevant, sample input/output. Keep functions small and testable.