I am building a contributor community around an open source banking gate, not an audience
Hi everyone, I am Rohan B. a third year Computer Engineering student from Pune, India. I build BankShield HumanGate, an open source gate that asks for passkey proof and device proof before money can move in a banking app. It is scheduled launched on Product Hunt, but this post is not about the launch. It is about the people I hope will build this with me.
The honest reason is simple. I am one student maintaining a security project, and attackers share tooling and techniques with each other every day. A gate designed by one mind carries the blind spots of that one mind. This project only becomes serious if other builders attack it, question it, and improve it in the open.
Real contribution here looks like this. You can propose a new attack case, especially a money movement scenario, and if it is accepted it joins the shared test set that every implementation must handle. You can port the gate to a new language, because the specification is written down and the Python, Go, and Rust implementations already prove themselves against the same 3000 shared cases. You can do hard review, read the gate logic, open an issue, and argue with the design, because a found weakness is a real contribution. And you can make the specification and the docs clearer for the next person who arrives.
Joining works plainly. Start with the contributor interest issue in the repository and introduce yourself with links to work you have already shipped. I read every profile personally, because this is banking security and trust matters, and then I share a short contributor form before deeper work begins. What counts here is finished work: a merged attack case, a passing port, a review that changes the design.
The current state, stated honestly: 3000 shared test cases, three stacks in full agreement, 0 attacks allowed on sensitive routes, and it is a demo with synthetic signals and no real bank data, with the production limits written plainly in the repository.
My question for the maintainers and contributors here: what made you stay and really contribute to a young open source project, instead of starring it and moving on? I want to build that kind of project, and I would rather learn it from this community than guess.
The repository, the specification, and the contributor interest issue live here:
Replies
Asking people to attack it is the right instinct. I've run enterprise-scale systems, and security problems are the ones that only show up once more people use the thing. One mind really can't see all of it. Good luck growing the contributor side!