Removed a fake, hardcoded GitHub repo browser from the resource detail page, and later removed a dead font-face declaration that was causing 4 failed requests per page load.
المساهمون
تُبنى RATQ بمساهمة المجتمع. هؤلاء المساهمون أصلحوا أخطاء وأغلقوا مشكلات وقدّموا تحسينات للمنصة.
Deleted dead i18n source files (en.ts / ar.ts) that were never imported, fixed the stale docs pointing to them, and later wired the developer comments page to real data instead of mock comments.
Fixed a missing 'Home' nav i18n key that was hardcoded as a ternary instead of going through the translation object.
Built this Contributors page and fixed the developer view navbar overlap, then built out the real developer notifications backend (a new Payload collection wired into access requests, reports, and comments), wired pagination into the resources catalog, found and fixed a stored XSS vulnerability in the JSON preview component, and later added four missing content pages (Contact, Privacy, Standards, Docs) with the footer links wired to them. Later added image upload support for resources, and then added a payload-backend typecheck step to CI after a type error slipped through undetected.
Stripped a stray UTF-8 BOM byte from source files, after independently verifying which of the originally-listed files still existed post-restructure.
Added an admin override so admins can delete or update any comment, while keeping regular users restricted to their own - with tests covering every role case.
Fixed a React hydration mismatch that fired on every page load for logged-in users, by moving the localStorage read out of the initial render and into a post-hydration effect.
Fixed pages loading scrolled-to-bottom and animating up on navigation, by adding smooth-scroll behavior to the html element - his own diagnosed fix from when he opened the issue. Later added bilingual accessibility labels to the pagination buttons, then added a sort dropdown to the resources catalog with URL-based state, matching the existing filter pattern.
Added a Contributor Covenant code of conduct and a short governance section explaining who has merge rights and how decisions get made, then documented AccessRequests' publisher-scope limitation.
Fixed the last two English strings that had slipped through the Report modal - the reason dropdown's default option and the details placeholder - wiring both through the existing i18n system with real Arabic/English translations and tests for both locales.
Wired the already-built AnnouncementsCarousel component into the homepage, replacing the old static banner that could only ever show one fixed message - the homepage now surfaces real, rotating announcements. Later did the same for Trending Resources, and found the real reason it had nothing to show (a downloads-based filter with no real download data yet to filter on).
Created CHANGELOG.md and added a Community section to the README linking to GitHub Discussions and the changelog, giving the project a public discussion channel and a clear changelog for anyone following along.
Fixed a UX gap where an already-authenticated user could still land on the login page and see the form again - added an automatic redirect to the dashboard, with a loading guard so the form never flashes on screen while the session is being checked, plus tests covering both states. Later added the access-control test coverage the Users and Resources collections were missing - privilege escalation, owner-spoofing, and slug-collision handling all included.
Built the real Payload backend for Announcements, replacing the mock data it had been running on - a proper collection with admin-only writes, public reads scoped to active/non-expired announcements, and resource links that resolve through the real catalog instead of pointing at fake resource IDs. Later added Edge Cache for GitHub repository previews, caching successful responses per-repository while explicitly excluding failed, invalid, or missing-token results from the cache.
Added accessible names to the catalog search input and the consumer avatar links, so screen reader users get a real label instead of relying on placeholder text or nothing at all.
Added session-expiry handling for authenticated API requests - an expired or invalid JWT now clears auth state and redirects to login with a clear message, while keeping that distinct from a genuine permission denial on a still-valid session.
Fixed a security gap where any authenticated user could generate an API key for any resource regardless of ownership or an approved access request - added a validation guard requiring resource ownership or an approved access request before allowing key creation, with test coverage for all three cases. Later fixed another security gap where draft/unpublished resources and their comments were publicly readable via the API - added multi-tier access control (owner, admin, public-published-only) to both collections, with full test coverage.
Added forgot-password, reset-password, and email-verification flows - previously missing entirely, so users who forgot their password now have a real way to recover their account.