Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

Hylozoic/hylo

• translation script sort reverses case
• Add Join button to events that have a virtual meeting link 15 minutes before the event

SecureBananaLabs/bug-bounty

• Registration token subject should match returned user id
• Technical Poem Generation and Content Creation
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Pixel Art Creation with high Creative Thinking
• upload endpoint accepts empty file submissions as successful uploads
• Low Handing Fruit Automation
• CORS configured without origin allowlist in app.js (reissue via #743)
• Implement Secure Payment Gateway and Payment Service
• Implement a fully functional Admin Panel
• CORS configured with no origin restrictions — allows any domain
• Job validation should reject inverted budget ranges
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Payment endpoint lacks authentication — unauthenticated payment creation
• Search endpoint has no input validation or length limit on query
• Automate Bug Detection and Reviews
• Reject inverted job budget ranges in job validation
• registerUser access token can reference a different user id
• auth refresh endpoint issues tokens without verifying the requester
• Freelancer profile route should resolve mock profiles by username
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Bug: user creation accepts empty payloads and client-controlled ids
• User creation endpoint has no input validation
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• POST /api/users endpoint missing authentication middleware (reissue via #743)

codeaashu/DevDisplay

• AI Tools Hub 💌 Enhance this features ⚡
• Project Idea Submission & Voting System 💌

nextcloud/deck

• Horizontal Scrollbar for Tables in Deck Card Descriptions

marola-dev/marola-site

• Critical: every site deploy re-fetches all external data, so a CSS merge fails when Overpass or Open-Meteo is busy
• Team page: the maintainers (h0ffmann, brunogbv, etc) with photo, GitHub and LinkedIn, next to Donate in the nav
• Partners page: advisors, and the open-source code, institutions and companies marola is built on

open-telemetry/opentelemetry.io

• [es] Spanish folder localization zero-code
• [pt] Localize content/en/docs/platforms pages
• [Docs]: Community Meeting Records links unusable
• [es] Spanish folder localization docs/Platforms
• [pt] Localize content/en/docs/zero-code/agent/configuration.md
• [es] Spanish folder localization docs/demo
• [pt] Localize content/en/docs/zero-code/java/spring-boot-starter/_index.md
• [pt] Localize content/en/docs/zero-code/agent/performance.md
• [pt] Localize content/en/docs/demo pages
• [pt] Localize content/en/docs/collector pages

Uuriko/project-room

• Contributor task: correct the public-receipts row in the access checklist
• Contributor task: bring the QA guide's CI map up to date
• Contributor task: document the existing UI string helper and catalog build
• Contributor task: add axe coverage for local password-reset forms
• Verify open-room share-link flow end-to-end post-#817; close #612 or file follow-ups
• scripts/room rebuild --commit-push aborts when --out is inside the repo cwd

vercel/next.js

• ISG with GIP in _app overrides cache-control of ISG page
• @next/next/no-html-link-for-pages rule does not work with pageExtensions

nextcloud/mail

• Add a CONST for the Oracle Max Chunk size and replace all occurrences
• Show email next to name in Search dropdown

leluong141996-dev/Agent-Brain-Hub

• Ontology: add a 'birthday' relation with vi/en/ja extraction rules
• UI: keyboard shortcut to focus the chat input and switch agents
• Docs: Japanese README (README.ja.md)

meshery/meshery.io

• Fix mobile spacing and alignment on MeshMates page
• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI
• Fix mobile responsive layout for GSoC Programs page
• [Bug] Copy Button Flickering on Hover

Jason-Vaughan/TangleClaw

• ui/integration: six v2 palette pairs fall below the 4.5:1 contrast floor
• [feature] Set CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0 for spawned Claude sessions — artifact tabs pile up on a host nobody watches
• projects: stranded-config guard misses .gemini artifacts
• wrap: changelog promotion emits headings with no link-reference defs
• [chore] Log when resolveSessionRange downgrades a session SHA to the trunk range

hackforla/website

• Epic: Create issues to resolve CodeQL alerts 1- 24, 98 "Potentially unsafe external link"
• Resolve "Potentially unsafe external link" for LA Incubator in _includes/about-page/about-card-sponsors.html
• Resolve "Potentially unsafe external link" for Carbon Five in _includes/about-page/about-card-sponsors.html
• Resolve "Potentially unsafe external link" for Sip & Sonder in _includes/about-page/about-card-sponsors.html
• Skills Issue: Developer: Juan Yepez
• Update Project Profile: HackforLA Website
• Populate github-handle for John Darragh in tdm-calculator.md
• Populate github-handle for Bonnie Wolfe in tdm-calculator.md
• Update docker-compose.yml: Remove top-level version element
• Replace Github with GitHub in assets/js/utility/api-events.js
• Replace Github with GitHub in github-actions/trigger-issue/add-missing-labels-to-issues/add-labels-template.md
• Update Project Profile: Hackforla.org Website Add Michael Hughes
• Update Project Profile: TDM Calculator (Update Project's Description)
• Remove Amen Divine Ikamba from Hackforla.org Website leadership
• Update Project Profile: Hackforla.org Website Remove Amen Divine Ikamba
• Add github-handle for Isabelle Wagenvoord in public-tree-map.md
• Review Needed - New Wins Form Submission
• Update Project Profile: Hackforla.org Website Add Sushma Ramachandra Hegde

nextcloud/forms

• Replace description fields with NcRichText

adaumsilva/OrchestrAI

• Project: add LICENSE, contributing guide and screenshots
• Open in IDE

nextcloud/contacts

• Store last selected Group and Contact
• [Bug]: Activity shows contact being created in the wrong address book

Fmarzochi/EGC

• test(v1.1.22): first install on Windows, npm and clone, and report
• test(v1.1.22): first install on macOS, npm and clone, and report

Secra-Solutions/Conector

• Add Audiobookshelf
• Add BookStack
• Add Karakeep (formerly Hoarder)
• Add Miniflux
• Add Mealie
• Add Sonarr and Radarr
• Add Forgejo
• Add Proxmox VE
• Add Nextcloud
• Add Jellyfin
• Add Paperless-ngx
• Add Immich

neomjs/neo

• Pin how CountryFlags turns a location into a flag
• Docs App: Routes
• config order: add an exception for layout to always be in front of items
• buildScripts/createClass: guessBaseClass() => add container.Viewport
• selection.HelixModel: toggleSelection & select
• tab.Container: Closable tabs
• Pin how IdGenerator names every instance
• Pin how the RPC API manager resolves each call's type and URL
• Pin Neo.util.Css: how CSS rules reach the main thread
• Pin when the toast manager refuses a toast
• Pin the range field's value-in-label display
• Pin the number field's spin-button trigger
• Pin how the progress, country-flag and GitHub-user grid columns map a record
• Pin which events the calendar's getDayRecords returns for a day
• Pin how the currency field parses and renders amounts
• Pin the ways ClassSystem.beforeSetInstance turns a config into an instance
• Pin HashHistory: one route stack per browser window

nextcloud/calendar

• Show proper metadata for when you post the link in social networks or chats

nextcloud/spreed

• Always show filters in conversation search
• Option to set "Original image quality" as default setting

career-ops-hq/career-ops

• h1b-sponsor: move the duplicated displayClean() into lib/
• Duplicated logic in process-quality.mjs and 2 more files: findColumn
• Use validateFlags() instead of hand-written flag checks in find.mjs, jd-similarity.mjs and application-answers.mjs
• apify plugin: write the JD frontmatter with js-yaml instead of yamlEscape
• i18n(pl): re-sync modes/pl/oferta.md (Polish) to the canonical A–H + Risk Summary structure
• i18n(fr): bring the French interview modes (plan/practice/debrief) back to parity with the English ones
• i18n: translate the interview modes (plan/practice/debrief) to Portuguese (Brazil)

pacocartones/free-llm-api-hub

• [good first issue] What does Typhoon (SCB 10X) do with your prompts? Record data_policy
• [good first issue] Does Pollinations.ai's free tier allow commercial use? Confirm commercial_ok
• What does Arli AI do with your prompts? Record data_policy
• [good first issue] Docs: explain data_policy in the first-provider tutorial
• [good first issue] What does W&B Inference do with your prompts? Record data_policy
• [good first issue] What does ModelScope (API-Inference) do with your prompts? Record data_policy
• [good first issue] What does NLP Cloud do with your prompts? Record data_policy
• [good first issue] What does Baseten do with your prompts? Record data_policy
• [good first issue] Does SiliconFlow's free tier allow commercial use? Confirm commercial_ok
• [good first issue] Does HuggingFace's free tier allow commercial use? Confirm commercial_ok
• [good first issue] Does Fireworks AI's free tier allow production use? Confirm commercial_ok

Kaycee276/Chesster

• [DOCS] docs(architecture): author system architecture overview and escrow sequence diagrams in docs/ARCHITECTURE.md
• [FRONTEND] fix(audio): implement Web Audio API procedural sound synthesis fallback in soundService
• [BACKEND] fix(retry): add randomized jitter to transaction retry backoff in transactionRetry.js
• [FRONTEND] fix(settings): add Blindfold Mode piece visibility toggles (hide white, hide black, hide all)
• [TESTING] test(frontend): author component tests for BroadcastScoreboard clock countdown and styling
• [FRONTEND] feat(chat): add quick chat phrase buttons and opponent mute toggle in ChatPanel
• [FRONTEND] fix(clock): format low turn timer countdown with tenths of a second precision below 10 seconds
• [BACKEND] fix(webhook): implement HMAC-SHA256 signature verification header for outbound webhooks
• [CONTRACTS] fix(escrow): emit dedicated PlayerJoined event with deposited amount and token address
• [FRONTEND] fix(theme): persist piece set preference (Classic, Modern, Wood) in localStorage and gameStore
• [BACKEND] fix(cache): add stale-while-revalidate caching header and TTL invalidation for public leaderboard endpoint
• [FRONTEND] fix(wallet): display auto-dismissing toast notifications on Freighter transaction submission errors
• [DEVOPS] ci(github): implement automated contract artifact size regression check in CI
• [FRONTEND] feat(a11y): add keyboard shortcut helper dialog and focus trap in modal components
• [CONTRACTS] fix(escrow): enforce minimum wager threshold check per whitelisted token
• [BACKEND] fix(chat): implement rate-limited sliding token bucket for in-game chat sockets
• [BACKEND] feat(replay): generate interactive PGN export with clock annotations and evaluation tags

tdk-landscape/tdk-app

• Small grey text in light mode is 3.4 to 3.6:1, below WCAG AA
• Panel titles are not headings, so screen readers skip them
• Truncated endpoint URLs and project paths have no tooltip
• docs: add CODE_OF_CONDUCT.md
• docs: add SECURITY.md with a private reporting route
• docs: add CONTRIBUTING.md
• docs: add issue templates for bugs and feature requests
• chore: enable Dependabot for npm
• chore: add .nvmrc matching engines.node
• ci: run npm test on pull requests
• test: add direct cases for maskPaths
• test: add direct tests for cleanupCandidates
• Refresh interval is hard-coded in both the footer text and the timer
• Local session dot is explained only by a hover tooltip
• Browser tab title does not show the open project
• Recent logs dialog has no Copy button

louislam/uptime-kuma

• [GDPR] Add cookies consent when Google Analytics is Enabled
• Support URL parameters so we can link directly to filtered dashboard view

GoogleChrome/lighthouse

• Audit proposal: Detect if React is development mode
• handling impact of isInputPending on long tasks metrics?

Bubblegunn/product-engineer

• Let the Action skip pull requests opened by bots
• Expose diff and references as Action inputs
• check --format json
• Python-flavoured plain-language table

accensa/x402-facilitator-stellar

• test: the outbox loop-error guard has no failing-claim test
• docs: monitoring README links point two levels above the repository
• test: assert the /admin/dlq routes' 400 and 404 rejection bodies
• docs: document FRIENDBOT_URL and FRIENDBOT_ATTEMPTS the funder reads
• docs: document the payee address and resource port npm run e2e reads
• docs: document the POSTGRES_URL fallback the migrate CLI accepts
• docs: document SERVER_STELLAR_PRIVATE_KEY the USDC preparer requires
• docs: point docs/OPERATOR.md at the .env.example that exists
• docs: add the Trustlines heading two pages link to in SELLER.md
• docs: .env.example names STELLAR_SECRET, a variable no code reads
• docs: Stop the glossary advertising an unimplemented scheme
• docs: document SMART_ACCOUNT_WASM, the fixture override the e2e reads

nextcloud/documentation

• Developer manual: mention the org's appstore-build-publish workflow
• Developer manual: what to clean up on uninstall in repair.rst
• Developer manual: copyable setup for PHP-CS-Fixer and ESLint
• Developer manual: validate and rate-limit outgoing mail in email.rst
• Developer manual: allowlist user-supplied columns and sort orders in database.rst
• Developer manual: add crypto APIs, unserialize and CSV injection to security.rst
• Developer manual: document registerSensitiveMethods() in logging.rst
• Developer manual: fix the attribute and CSP examples in controllers.rst