Cosr-Backup · pull · Aug 22, 2026 · Aug 22, 2026 · Aug 22, 2026 · Aug 22, 2026
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: 📖 Documentation
+    url: https://docs.ipcheck.ing
+    about: Deployment, MaxMind setup, environment variables, and how each tool works.
+  - name: 💬 Questions & help
+    url: https://github.com/jason5ng32/MyIP/discussions/categories/q-a
+    about: Setup help, "why does my result look like this", and anything that isn't a bug.
+  - name: 🔒 Report a security vulnerability
+    url: https://github.com/jason5ng32/MyIP/security/advisories/new
+    about: Private report, visible only to the maintainer. Please don't open a public issue.
diff --git a/.gitignore b/.gitignore
@@ -54,10 +54,13 @@ common/as-rel-db/*.next
 docs/
 .plan/
 
-# Local Scripts (fetch-favicons.js is the one public exception —
-# contributors need it for the Connectivity favicon pipeline)
+# Local Scripts (the listed exceptions are public — contributors need
+# fetch-favicons.js for the Connectivity favicon pipeline, and the i18n pair
+# to scaffold a locale pack and see how far along it is)
 scripts/*
 !scripts/fetch-favicons.js
+!scripts/i18n-status.js
+!scripts/i18n-scaffold.js
 
 # Section banners — deploy-time data (ads and campaign promos stay out of git)
 frontend/data/banners/*

diff --git a/AGENTS.md b/AGENTS.md
@@ -15,7 +15,7 @@ halves: a Vue 3 SPA front-end and an Express 5 back-end API.
 
 | Layer | Technology |
 |---|---|
-| Frontend | Vue 3 (`<script setup>`) · Pinia · vue-router (HTML5 history) · vue-i18n (`en`/`zh`/`fr`/`ru`) |
+| Frontend | Vue 3 (`<script setup>`) · Pinia · vue-router (HTML5 history) · vue-i18n (locales registered in `common/locale-registry.js`) |
 | Build | Vite + `@vitejs/plugin-vue`; Tailwind CSS v4 + `tw-animate-css` |
 | UI | shadcn-vue copy-in primitives (reka-ui) · lucide icons · circle-flags via `@iconify/vue` · vaul-vue drawer · vue-sonner toast |
 | Backend | Express 5 |
@@ -88,9 +88,13 @@ use npm / yarn — they'd produce a competing lockfile.
 
 ### i18n coverage
 
-- Copy-surfacing features land in **all four locales** in the same change —
-  including `frontend/data/changelog.json` entries
-  (`tests/changelog.test.js` enforces it).
+- Copy-surfacing features land in **every `full` locale** in the same change —
+  including `frontend/data/changelog.json` entries (`tests/changelog.test.js`
+  and `tests/locale-packs.test.js` enforce it against `en`). `beta` locales are
+  free to lag: their gaps resolve down the fallback chain in
+  `common/locale-registry.js`, which is also where a new language is registered.
+- Contributor-facing walkthrough: [TRANSLATING.md](TRANSLATING.md) — keep it in
+  step when the registry, the pack gate or `pnpm i18n-status` changes.
 
 ### Logging (backend)
 

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -59,8 +59,12 @@ representative at an online or offline event.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-.
+reported privately to the maintainer using GitHub's
+[private report form](https://github.com/jason5ng32/MyIP/security/advisories/new)
+— it reaches only the maintainer; start the report with "Code of Conduct" so it
+isn't triaged as a security issue. Behavior that violates
+[GitHub's own terms](https://github.com/contact/report-abuse) can also be
+reported to GitHub directly.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing to MyIP
 
-Thanks for your interest in contributing! MyIP ([IPCheck.ing](https://ipcheck.ing)) is an
+Thanks for your interest in contributing! MyIP (demo website: [IPCheck.ing](https://ipcheck.ing)) is an
 open-source IP toolbox — IP lookup, connectivity tests, WebRTC / DNS-leak detection,
 speed test, and more — built as a Vue 3 SPA with an Express 5 backend.
 
@@ -57,8 +57,9 @@ Details and rationale live in the AGENTS.md files; the headlines:
 - **JavaScript only** — no TypeScript, no `lang="ts"`.
 - **New functions use `const` arrow syntax** (`const fn = async () => {}`).
 - **Every new file opens with a header comment** stating its purpose.
-- **Four locales land together** — user-visible copy ships in `en` / `zh` / `fr` / `ru`
-  in the same PR (`frontend/locales/`; tests enforce this for some surfaces).
+- **The `full` locales land together** — user-visible copy ships in `en` / `zh` / `fr` /
+  `ru` in the same PR (`frontend/locales/`; tests enforce it). `beta` locales are exempt —
+  they fall back to English.
 - **Backend logging goes through the shared pino logger** (`common/logger.js`) —
   no `console.*` in `api/` or `common/`.
 
@@ -88,15 +89,19 @@ existing READMEs. Keep code blocks, URLs, and badges unchanged. Check open issue
 for requested languages before starting.
 
 **UI translations** — improvements to the existing `en` / `zh` / `fr` / `ru` packs are
-welcome. Adding a whole new UI locale is heavier than it looks (every future copy
-change must land in it too), so please open an issue to discuss before starting one.
+welcome, and so is a whole new language. Adding one is two files: a locale pack under
+`frontend/locales/` and a line in `common/locale-registry.js`. **A partial pack is a
+welcome first PR** — anything you don't translate falls back to English, and the language
+ships as `beta` until it's complete. Full walkthrough: **[TRANSLATING.md](TRANSLATING.md)**.
 
 ## Bugs & feature requests
 
 Use the issue templates in [`.github/ISSUE_TEMPLATE/`](.github/ISSUE_TEMPLATE/) —
 one for bug reports (include terminal / browser console logs) and one for feature
-requests. For general questions, GitHub Issues is also the right place; there are
-no chat channels.
+requests. Questions, setup help, and "is this a bug?" go to
+[Discussions → Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a)
+instead — see [SUPPORT.md](SUPPORT.md). Security vulnerabilities go through the
+private channel in [SECURITY.md](SECURITY.md), never a public issue.
 
 ## Testing
 

diff --git a/README.md b/README.md
@@ -104,6 +104,7 @@ Full guides live in the MyIP Docs Center: **[docs.ipcheck.ing](https://docs.ipch
 Contributions are welcome! We keep a curated set of beginner-friendly tasks — each with exact file paths, acceptance criteria, and tests that guide you to a green build:
 
 * 🏷️ [Good first issues](https://github.com/jason5ng32/MyIP/labels/good%20first%20issue) — add a DNS resolver from your country, add curated site lists, translate the README into your language, polish translations, and more
+* 🌐 [TRANSLATING.md](TRANSLATING.md) — bring the UI to your language: a locale pack plus one registry line, and a **partial translation is a welcome first PR**
 * 📄 [CONTRIBUTING.md](CONTRIBUTING.md) — setup, conventions, and how PRs flow (target the `dev` branch)
 
 ## ⚙️ Configuration

diff --git a/README_FR.md b/README_FR.md
@@ -104,6 +104,7 @@ Les guides complets se trouvent dans le centre de documentation MyIP : **[docs.i
 Les contributions sont les bienvenues ! Nous maintenons une sélection de tâches adaptées aux débutants — chacune avec les fichiers précis, les critères d'acceptation et des tests pour vous guider :
 
 * 🏷️ [Good first issues](https://github.com/jason5ng32/MyIP/labels/good%20first%20issue) — ajouter un résolveur DNS de votre pays, enrichir les listes de sites, traduire le README dans votre langue, améliorer les traductions…
+* 🌐 [TRANSLATING.md](TRANSLATING.md) — mettez l'interface à votre langue : un paquet de langue plus une ligne dans le registre, et **des traductions partielles sont les bienvenues pour votre première PR**
 * 📄 [CONTRIBUTING.md](CONTRIBUTING.md) — installation, conventions et flux des PR (ciblez la branche `dev`)
 
 ## ⚙️ Configuration

diff --git a/README_RU.md b/README_RU.md
@@ -104,6 +104,7 @@ docker run -d -p 18966:18966 --name myip --restart always jason5ng32/myip:latest
 Мы рады вашему участию! У нас есть подборка задач для новичков — с точными путями к файлам, критериями приёмки и тестами, которые ведут вас к зелёной сборке:
 
 * 🏷️ [Good first issues](https://github.com/jason5ng32/MyIP/labels/good%20first%20issue) — добавьте DNS-резолвер своей страны, расширьте подборки сайтов, переведите README на свой язык, улучшите переводы
+* 🌐 [TRANSLATING.md](TRANSLATING.md) — переведите интерфейс на свой язык: один языковой пакет и одна строка в регистре, а также **частичные переводы — это приветствуемый первый PR**
 * 📄 [CONTRIBUTING.md](CONTRIBUTING.md) — настройка окружения, соглашения и процесс PR (PR направляются в ветку `dev`)
 
 ## ⚙️ Конфигурация

diff --git a/README_ZH.md b/README_ZH.md
@@ -104,6 +104,7 @@ docker run -d -p 18966:18966 --name myip --restart always jason5ng32/myip:latest
 欢迎参与贡献！我们维护着一批对新手友好的任务，每条都写明了具体文件、验收标准，并有测试引导你完成：
 
 * 🏷️ [Good first issues](https://github.com/jason5ng32/MyIP/labels/good%20first%20issue) —— 添加你所在国家的 DNS 解析服务、添加精选网站列表、把 README 翻译成你的语言、润色翻译等
+* 🌐 [TRANSLATING.md](TRANSLATING.md) —— 把 UI 带到你的语言：一个语言包加上一行注册表，以及 **部分翻译也是欢迎的首次 PR**
 * 📄 [CONTRIBUTING.md](CONTRIBUTING.md) —— 环境搭建、开发约定与 PR 流程（请将 PR 提交到 `dev` 分支）
 
 ## ⚙️ 配置

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,26 +1,46 @@
-## Reporting a Vulnerability
+# Security Policy
 
-The security of our project is a top priority. If you discover a security vulnerability, we encourage you to report it directly through our GitHub Issues.
+## Supported versions
 
-### How to Report a Vulnerability
+Only the latest release gets security fixes. Older tags are not patched — if you
+self-host, upgrade before reporting.
 
-1. **Report Through GitHub Issues**: Please create a new issue in our [GitHub Issues page](https://github.com/jason5ng32/MyIP/issues). Provide a clear and detailed description of the potential vulnerability. Include steps to reproduce it, if possible.
+## Reporting a vulnerability
 
-2. **Avoid Public Disclosure**: To protect the community, please do not disclose the vulnerability publicly until we have had a chance to address it.
+**Report privately, not through a public issue.** Use GitHub's private reporting form:
 
-3. **Response Time**: We aim to respond to security issue reports within 48 hours, acknowledging receipt.
+**[Report a vulnerability →](https://github.com/jason5ng32/MyIP/security/advisories/new)**
 
-4. **Updates**: We will keep you informed about our progress on the issue through the GitHub Issues thread.
+It's visible only to the maintainer, and it's the right channel even if you're unsure
+whether what you found is a real issue.
 
-5. **Credit**: We value your contribution to the security of this project. We will acknowledge your efforts in the GitHub Issue thread and in our release notes, if a fix is implemented.
+Helpful things to include:
 
-## Security Update Process
+- What an attacker can do with it, and what they'd need to start (a session? just a URL?).
+- Steps to reproduce — a request, a payload, or a short script.
+- Where the problem lives: front-end (`frontend/`), API handler (`api/`), or shared
+  code (`common/`).
+- Whether you hit it on [ipcheck.ing](https://ipcheck.ing) or your own deployment, and
+  the version if self-hosted.
 
-Upon receiving a report of a vulnerability, our team will:
+## What to expect
 
-- Promptly investigate the issue.
-- Develop a fix and test it thoroughly.
-- Release an updated version that addresses the issue.
-- Provide updates and patches as needed.
+- An acknowledgement within a few days.
+- A fix in the next release once it's confirmed, or an explanation if it turns out to be
+  out of scope.
+- Credit in the release notes and the advisory, unless you'd rather stay anonymous.
 
-Thank you for helping us keep our project safe and secure.
+Please hold off on public disclosure until a fix ships.
+
+## Out of scope
+
+- **Findings against [ipcheck.ing](https://ipcheck.ing) infrastructure** rather than this
+  codebase — rate limits, TLS configuration, DNS, hosting. Report those the same way, but
+  they aren't code issues.
+- **Third-party data providers.** MyIP queries external IP-geolocation and network APIs;
+  their vulnerabilities belong to them.
+- **Automated scanner output** with no working proof of concept.
+- **Missing optional hardening in a self-hosted instance.** `ALLOWED_DOMAINS` and the
+  other environment settings are documented in the
+  [Developer Guide](https://docs.ipcheck.ing/developer) — an instance running without them
+  is misconfigured, not vulnerable.
diff --git a/SUPPORT.md b/SUPPORT.md
@@ -0,0 +1,41 @@
+# Getting help
+
+Start with the docs, then pick the channel that matches what you need.
+
+## Documentation first
+
+The **[MyIP Docs Center](https://docs.ipcheck.ing)** covers most questions, in English,
+中文, français and русский:
+
+- **[Developer Guide](https://docs.ipcheck.ing/developer)** — deployment (Node, Docker,
+  Vercel), MaxMind setup, reverse proxies and `ALLOWED_DOMAINS`, environment variables,
+  architecture.
+- **[Knowledge Base](https://docs.ipcheck.ing/knowledge-base)** — what each tool measures
+  and how to read its results.
+
+Two settings account for most self-hosting problems: MaxMind credentials (without them
+the MaxMind source returns 503) and `ALLOWED_DOMAINS` (without it every request from a
+non-localhost domain gets 403).
+
+## Where to ask
+
+| You want to… | Go to |
+|---|---|
+| Ask how to do something, or why a result looks odd | [Discussions → Q&A](https://github.com/jason5ng32/MyIP/discussions/categories/q-a) |
+| Report a bug you can reproduce | [New issue → Bug report](https://github.com/jason5ng32/MyIP/issues/new?template=bug_report.md) |
+| Suggest a feature | [New issue → Feature request](https://github.com/jason5ng32/MyIP/issues/new?template=feature_request.md) |
+| Report a security vulnerability | [Private advisory](https://github.com/jason5ng32/MyIP/security/advisories/new) — see [SECURITY.md](SECURITY.md) |
+| Contribute code or a translation | [CONTRIBUTING.md](CONTRIBUTING.md) · [TRANSLATING.md](TRANSLATING.md) |
+
+There are no chat channels — everything happens on GitHub, in the open, so the next
+person with the same question can find the answer.
+
+## Making your question answerable
+
+Deployment questions need: how you're running it (Docker / Node / Vercel), the version,
+what you set for `ALLOWED_DOMAINS` and MaxMind, and the backend terminal output.
+Page questions need: browser, what you saw versus what you expected, and any errors from
+the browser console.
+
+MyIP is maintained by one person in their spare time. Replies aren't instant, and a
+question that already contains the details above gets answered a lot sooner.