Fix CI lint failures and address repository quality issues

CONTRIBUTING.md

@@ -0,0 +1,209 @@
+# Contributing to BlueLens
+
+Thank you for your interest in contributing to BlueLens! This document provides guidelines and instructions for contributing to the project.
+
+## Code of Conduct
+
+Please be respectful and constructive in all interactions with the community. We aim to maintain a welcoming environment for all contributors.
+
+## Getting Started
+
+### Prerequisites
+
+- Node.js 18 or later (Node.js 20 recommended)
+- Git
+- A code editor (VS Code, Sublime, etc.)
+
+### Development Setup
+
+1. **Fork and Clone**
+
+   ```bash
+   git clone https://github.com/your-username/bluelens.git
+   cd bluelens
+   ```
+
+2. **Install Dependencies**
+
+   ```bash
+   npm install
+   ```
+
+3. **Run the Development Server**
+
+   ```bash
+   npm start
+   ```
+
+   Then open http://localhost:8787 in your browser.
+
+4. **Run Tests**
+   ```bash
+   npm test
+   ```
+
+## Development Workflow
+
+### Before Making Changes
+
+1. Create a new branch for your work:
+
+   ```bash
+   git checkout -b feature/your-feature-name
+   ```
+
+2. Make sure all tests pass:
+   ```bash
+   npm test
+   ```
+
+### Making Changes
+
+1. **Write Quality Code**
+   - Follow the existing code style and conventions
+   - Keep functions focused and reasonably sized
+   - Add comments for complex logic
+   - Use meaningful variable and function names
+
+2. **Code Style**
+   - We use ESLint and Prettier for code formatting
+   - Run linting before committing:
+     ```bash
+     npm run lint
+     npm run format:check
+     ```
+   - Auto-fix issues when possible:
+     ```bash
+     npm run lint:fix
+     npm run format
+     ```
+
+3. **Testing**
+   - Add tests for new features
+   - Update existing tests if behavior changes
+   - Ensure all tests pass: `npm test`
+   - Check test coverage: `npm run test:coverage`
+
+4. **Documentation**
+   - Update relevant documentation in the `docs/` folder
+   - Update README.md if adding user-facing features
+   - Add JSDoc comments for new functions
+
+### Commit Messages
+
+Write clear, descriptive commit messages:
+
+- Use present tense ("Add feature" not "Added feature")
+- Use imperative mood ("Move cursor to..." not "Moves cursor to...")
+- Keep the first line under 72 characters
+- Add detailed description if needed after a blank line
+
+Examples:
+
+```
+Add OCR confidence threshold configuration
+
+Allow users to configure minimum confidence level for OCR text extraction
+via the bluelens-config.js file. Defaults to 60% confidence.
+```
+
+### Pull Requests
+
+1. **Before Submitting**
+   - Ensure all tests pass
+   - Run linting and fix any issues
+   - Update documentation
+   - Rebase on the latest main branch if needed
+
+2. **PR Description**
+   - Clearly describe what the PR does
+   - Reference any related issues (e.g., "Fixes #123")
+   - Include screenshots for UI changes
+   - List any breaking changes
+
+3. **Review Process**
+   - Respond to feedback constructively
+   - Make requested changes in new commits (don't force-push during review)
+   - Once approved, we may squash commits when merging
+
+## Areas for Contribution
+
+### Good First Issues
+
+Look for issues labeled `good first issue` - these are suitable for newcomers.
+
+### High-Priority Areas
+
+- **Testing**: Improve test coverage for edge cases
+- **Documentation**: Enhance user guides and API documentation
+- **Accessibility**: Improve keyboard navigation and screen reader support
+- **Performance**: Optimize large file handling and OCR processing
+- **Modularization**: Help break down large files (especially `app.js`)
+
+### Feature Requests
+
+Before implementing a new feature:
+
+1. Check if an issue exists for it
+2. If not, create a feature request issue
+3. Discuss the approach with maintainers
+4. Wait for approval before starting significant work
+
+## Project Structure
+
+```
+bluelens/
+├── app.js              # Main frontend application logic
+├── server.js           # Local HTTP server
+├── index.html          # Main UI
+├── styles.css          # UI styling
+├── bluelens-config.js  # Configuration
+├── bluelens-helpers.js # Utility functions
+├── ocr-pipeline.js     # OCR processing
+├── ocr-entities-ui.js  # Entity extraction UI
+├── osint-lib.js        # OSINT search engine integration
+├── launchpad-core.js   # Search engine launcher
+├── logger.js           # Logging utilities
+├── test/               # Test files
+├── docs/               # Documentation
+└── assets/             # Static assets
+```
+
+## Coding Conventions
+
+### JavaScript
+
+- Use `const` and `let`, not `var`
+- Prefer arrow functions for callbacks
+- Use template literals for string interpolation
+- Destructure objects when accessing multiple properties
+- Use optional chaining (`?.`) for safe property access
+
+### Naming
+
+- `camelCase` for variables and functions
+- `PascalCase` for classes
+- `UPPER_SNAKE_CASE` for constants
+- Prefix unused variables with underscore (`_variable`)
+
+### Comments
+
+- Use `//` for single-line comments
+- Use `/* */` for multi-line comments
+- Add JSDoc comments for public functions
+- Explain "why" not "what" in comments
+
+## Getting Help
+
+- **Questions**: Open a discussion on GitHub
+- **Bugs**: Create an issue with reproduction steps
+- **Features**: Create a feature request issue
+- **Security**: See SECURITY.md for reporting vulnerabilities
+
+## License
+
+By contributing to BlueLens, you agree that your contributions will be licensed under the MIT License.
+
+---
+
+Thank you for contributing to BlueLens! 🌊

README.md

@@ -176,6 +176,7 @@ npm test
 - choosing an image stays local until you launch a provider action
 - upload proxy uses ranked temporary-host failover
 - OCR model files load from a CDN on first use
+- **Browser-loaded libraries**: BlueLens loads external libraries (exifr, Tesseract.js, SparkMD5, sha256) directly in the browser via CDN for flexibility and to keep the server-side footprint minimal. These are not listed as npm dependencies because they're browser-loaded, not bundled.
 - capture-time exports preserve raw value, normalized value, source field, and timezone ambiguity notes
 - the evidence pack includes report data and reproducibility metadata
 - `BLUELENS_ALLOW_PRIVATE_FETCH=1` is for controlled local testing only
@@ -208,27 +209,32 @@ For detailed documentation, see the [docs/](./docs) folder:
 ## 🧑‍💻 Development
 
 **Install development tools**:
+
 ```bash
 npm install
 ```
 
 **Run tests**:
+
 ```bash
 npm test
 ```
 
 **Run tests with coverage**:
+
 ```bash
 npm run test:coverage
 ```
 
 **Linting**:
+
 ```bash
 npm run lint
 npm run lint:fix
 ```
 
 **Formatting**:
+
 ```bash
 npm run format:check
 npm run format

SECURITY.md

@@ -0,0 +1,59 @@
+# Security Policy
+
+## Supported Versions
+
+BlueLens is currently in active development. Security updates will be provided for the latest version.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| Latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in BlueLens, please report it responsibly:
+
+### How to Report
+
+1. **Do NOT** create a public GitHub issue for security vulnerabilities
+2. Send a detailed report to the repository maintainers via:
+   - GitHub Security Advisories (preferred): Use the "Security" tab → "Report a vulnerability"
+   - Or create a private security advisory
+
+### What to Include
+
+Please include the following information in your report:
+
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact and severity assessment
+- Any suggested fixes or mitigations (if available)
+- Your contact information for follow-up questions
+
+### Response Timeline
+
+- **Acknowledgment**: We aim to acknowledge receipt of your vulnerability report within 48 hours
+- **Initial Assessment**: We will provide an initial assessment within 5 business days
+- **Updates**: We will keep you informed of progress toward a fix
+- **Disclosure**: We will work with you to coordinate responsible disclosure after a fix is available
+
+### Security Best Practices
+
+When using BlueLens:
+
+- Keep your Node.js environment up to date (Node.js 18 or later required)
+- Review uploaded images to ensure they don't contain sensitive information before sharing externally
+- Be cautious when using the acquisition layer features with untrusted URLs
+- Regularly update dependencies by running `npm update`
+- Use the local-first approach to keep sensitive image analysis offline when possible
+
+## Security Features
+
+BlueLens is designed with security in mind:
+
+- **Local-first processing**: Image analysis happens locally by default
+- **No automatic uploads**: Images are only uploaded when you explicitly choose to
+- **Configurable upload hosts**: Control which services are used for image uploads
+- **Rate limiting**: Built-in rate limiting for acquisition layer requests
+- **Content Security Policy**: Frontend implements CSP headers (when served via the local server)
+
+Thank you for helping keep BlueLens and its users secure!