Thanks for your interest in this fork! It's a personally maintained fork of Gophish, focused on dependency/security updates and curated fixes from the upstream backlog. Contributions are very welcome — bug reports, fixes, and small improvements especially so.
There's no formal process: open an issue or pull request. By submitting a pull request, you confirm that you wrote the contribution yourself (or otherwise have the right to submit it) and agree to license it under this project's MIT License. Since this is maintained by one person in their spare time, response times may vary, and larger PRs that weren't discussed in an issue first may take a while to review.
Please report suspected security vulnerabilities privately — see SECURITY.md. Do not open a public issue for a suspected vulnerability.
Please file an issue with as much detail as possible (steps to reproduce, expected vs. actual behavior, Gophish version/commit). Usage questions belong in Discussions, not issues.
Backend (Go 1.25+):
go build .
go test ./...
gofmt -l . # must produce no output - CI checks this exactlyFrontend assets (Node 22+) are built with a single esbuild script:
npm ci
npm run build # writes static/js/dist and static/css/distLinting uses golangci-lint; CI only fails on issues introduced by your
change (only-new-issues), not the pre-existing backlog, so no need to fix
unrelated files in passing.
If you're changing the Dockerfile, you can trigger a build-only check
without publishing anything via the "Docker Build Check" workflow under the
Actions tab (manual trigger).
- Keep PRs focused - one change per PR is easier to review than a bundle of unrelated fixes.
- Make sure
go build .,go test ./..., andgofmt -l .are clean before opening. - CI runs the same checks (build, tests, lint,
govulncheck) automatically.