Many developers want to contribute to open source and stall at the first step. A practical path from choosing a project and an issue to reproducing the bug, following CONTRIBUTING rules, making a small change, writing the pull request, handling review and DCO or CLA requirements.
Attackers copy popular repositories, add malware and promote the copies with similar names and fake stars. A practical guide for maintainers and users: how fake clones and repojacking work, how to make the real project verifiable with signed releases and provenance, and what to check before installing.
A developer committed a .env file with a live AWS access key, then deleted it in the next commit. The key stayed in history. We revoked it within 40 minutes, checked CloudTrail, rewrote history with git filter-repo and added scanning so it cannot happen again.