This comes before everything else. Open a dispute with the address and the transaction. No proof of identity is needed, and nothing secret should ever be posted. It gets checked against the chain, and a listing that does not hold up comes off the site with the totals moved to match.
The case most likely to be wrong is the one the detector cannot see. An owner who followed Coinkite's advisory, swept their coins to a new wallet at an urgent fee, and landed in a fresh multisig produced the same shape a thief does. If that is what happened, saying so is enough to get it reviewed.
Detectors, methodology, documentation, and tests. A change that makes a detector catch something it currently misses is the most useful contribution available. So is a test that pins behaviour the tests do not yet cover.
Not address data. Everything under data/ is generated by the detectors rather than
edited by hand, and the site is built from it. A pull request that adds or removes an
address will be closed, because the value of the dataset is that no human hand-picked it.
Change the detector, or open an issue with the reproduction, and the data regenerates.
python3 -m unittest discover -s tests -v # 25 tests, no node and no network needed
python3 check_clean.py --selftest # the leak gate still catches what it claims to
python3 check_clean.py # nothing in the tree that should not ship
CI runs all three. check_clean.py refuses anything that would publish a node address, a
Keychain service name, a home directory path, a credential, or the name of a machine or
person behind the project. Comments written for a private repo carry those without anyone
noticing, which is exactly how eleven of them reached the first public push.
Nothing enforced beyond the tests. The one convention worth keeping: comments here explain why, and where a rule exists because something went wrong, they say what went wrong. A detector that rejects address reuse looks reasonable until you know it silently dropped 63 sweeps, so the code says so.
Optional. Everything falls back to public block explorers, but a node is about five times faster and supplies the funding height of each input, which the firmware-epoch test needs. See the README. No node address ever enters this repo.