Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

Jason-Vaughan/TangleClaw

• [chore] Nothing asserts the README's two clone pins match version.json — they go stale on every release, by hand
• [bug] Settings modal clips hint text — long code tokens overflow the toggle grid's cells
• ui/integration: six v2 palette pairs fall below the 4.5:1 contrast floor
• [feature] Set CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0 for spawned Claude sessions — artifact tabs pile up on a host nobody watches
• tests: stop regex-matching exact public/* source text in frontend tests
• Tighten FEATURES.md citation-contract coverage
• [chore] Log when resolveSessionRange downgrades a session SHA to the trunk range
• wrap: changelog promotion emits headings with no link-reference defs
• session-rules: restore returns CONFIRM_REQUIRED for an unknown versionNo
• projects: stranded-config guard misses .gemini artifacts
• tests: convert the remaining non-strict node:assert suites to strict
• Add JSDoc to the 9 undocumented private helpers
• Suppress node:sqlite ExperimentalWarning via --disable-warning flag

vercel/next.js

• Redux-observable server side fetching
• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• getInitialProps is not running when Router.replace's "href" and "as" contains hash and query params inside "href" change.
• Scrolling happens when user returns to a page with hash using browser back button
• Dynamic Routes in Symlinks is not working
• Misleading "next-head-count is missing" error for invalid head tags
• POST request succeeds for pages with next dev
• Inconsistent Error Messaging / Handling in getStaticPaths
• Parameter on AppType is used incorrectly

nextcloud/mail

• Add a CONST for the Oracle Max Chunk size and replace all occurrences

meshery/meshery.io

• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI
• [Bug] Fix Meshery Docs Link Styling
• [Bug] Copy Button Flickering on Hover
• Website: Consolidate duplicative and unused CSS

nodejs/doc-kit

• The tooltips for methods or attributes in the sidebar are not fully displayed.

WordPress/gutenberg

• Restore the full search visibility in embed links
• Typescript - introduce new @wordpress/ts-config package for outside usage
• Pasting direct image URL inserts Embed block instead of Image block
• The category set in Default Post Category is not selected in the display when posting a new post.
• Make tooltips dismissable
• Cover block: empty block shows as black box on frontend
• Dependency Extraction Webpack Plugin: Prettify the output of the development asset files
• Custom font upload not working
• Twitter embed block should expose options for how the tweet is displayed
• Improve the manual git cherry-pick instructions left when performing an automatic cherry-pick fails
• Documentation: Clarify the behavior of parent when empty during block registration
• Allow the PanelColorSettings to be visible if no colors and but with children
• NumberControl: Disable dragging on touch devices

mithun-srinivas/DoxDock

• Grayscale PDF: convert a whole PDF to black and white

ToolJet/ToolJet

• [docs]: macOS contributor setup fails because postgresql@13 is disabled in Homebrew

nextcloud/contacts

• Contact Groups edit field: horizontal scrollbar covers the contact group(s)

Zoverions/AXIOM-MESH

• Security Agent Cell Pilot #1 — independently attack RT-AUTH-001
• Agent Community engagement: first outside Security Cell result
• Community Testnet v0 — recruit independent operators and hardware evidence
• Agent Commons: external-agent contribution and interoperability layer

nextcloud/spreed

• Inconsistent padding for dashboard widgets
• Recording chunked upload would fail with token length > 13
• Go back to autopilot mode if re-clicking selected participant
• Dashboard widget should show the actual mention message
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• Guests in voice-rooms do not see "Leave call" button
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Instant meeting outside of dashboard?

Fmarzochi/EGC

• test(v1.1.21): break the Guardian or the Token Crusher and report
• test(v1.1.21): upgrade an existing install with egc auto-update and report
• test(v1.1.21): two tools, one brain: does the memory really cross tools?
• test(v1.1.21): first install on Windows, npm and clone, and report
• test(v1.1.21): first install on macOS, npm and clone, and report
• test(v1.1.21): first install on Linux, npm and clone, and report

career-ops-hq/career-ops

• set-status.mjs: the JSON result must be the last thing on stdout, and nothing pins it
• i18n(pl): re-sync modes/pl/oferta.md (Polish) to the canonical A–H + Risk Summary structure
• update-system.mjs commits the auto-update onto whatever branch you are on, including a contributor's feature branch
• i18n(fr): bring the French interview modes (plan/practice/debrief) back to parity with the English ones
• feat(cli): four documented scripts have no --help — add the usage block (one script per PR)
• feat(scan): domain-level aggregator repost list, complementing the SimHash cross-listing warning
• fix(analyze-patterns): --min-threshold and --min-vendor-n values are never validated
• Umbrella: bring the Hired Wall section to the 16 localized READMEs
• i18n(ua): re-sync modes/ua/oferta.md (Ukrainian) to the canonical A–H + Risk Summary structure
• i18n: add the interview README to de/id/ru/ua/zh (one language per PR)
• docs(i18n): the 16 translated READMEs still describe the report as A-F; it is A-H
• verify-cv-facts: flag scope-verb inflation and unsourced adoption claims, not just numbers
• i18n(pt): re-sync modes/pt/oferta.md (Portuguese) to the canonical A–H + Risk Summary structure
• i18n(es): re-sync modes/es/oferta.md (Spanish) to the canonical A–H + Risk Summary structure
• i18n(da): re-sync modes/da/oferta.md (Danish) to the canonical A–H + Risk Summary structure
• Native-speaker check wanted: the human-in-the-loop row in 11 languages (a940028a)
• i18n: translate the interview modes (plan/practice/debrief) to Portuguese (Brazil)
• i18n: translate the interview modes (plan/practice/debrief) to German
• i18n: translate the interview modes (plan/practice/debrief) to Spanish
• i18n: translate the interview modes (plan/practice/debrief) to Indonesian
• docs(i18n): translate the new README FAQ into the remaining 13 languages
• i18n: translate the interview modes (plan/practice/debrief) to Polish
• i18n: translate the interview modes (plan/practice/debrief) to Korean
• i18n: translate the interview modes (plan/practice/debrief) to Japanese

louislam/uptime-kuma

• Password Reset via CLI does not work on Embedded MariaDB
• Pausing a group does not pause the individual monitors of that group

jellyfin/jellyfin-web

• The homepage only displays the backdrops from libraries of the "movie" type

layer5io/docs

• [Bug] Image not rendering correctly
• Screen capture includes Grammarly

usebruno/bruno

• Proxying should support HTTP and HTTPS at the same time
• Close multiple collections at once

holeyfield33-art/runtime-firewall-mvp

• (0,eval) indirect-eval produces no standalone indicative-pattern WARN (isolated case)
• non existing function call

TryGhost/Ghost

• Share profile image generation is broken for some avatars and cover images
• 🌐 i18n mega-issue

Foundryborne/daggerheart

• [Feature] - Idiot Proofing

cardano-foundation/cardano-org

• Refresh stale glossary entries and add the missing current terms
• Help translate cardano.org into your language

Berserk-hub150/skillhawk

• [Good First Issue] Add a SARIF-result tip [MC-015]
• [Good First Issue] Add an actionable-remediation tip [MC-003]
• [Good First Issue] Add a minimal-evidence tip [MC-002]
• [Good First Issue] Add a false-positive review tip [MC-004]
• [Good First Issue] Add a severity calibration tip [MC-006]
• [Good First Issue] Add a narrow-rule design tip [MC-005]
• [Good First Issue] Add a safe-fixture writing tip [MC-007]
• [Good First Issue] Add a suspicious-fixture writing tip [MC-008]
• [Good First Issue] Add a redaction tip [MC-009]
• [2–5 min] Define static analysis for beginners
• [Good First Issue] Add a regression-test tip [MC-014]
• [Good First Issue] Add a path-traversal review tip [MC-031]
• [Good First Issue] Add a SKILL.md trust-boundary tip [MC-012]
• [2–5 min] Define prompt injection for beginners
• [2–5 min] Add one prompt-injection remediation tip
• [2–5 min] Add one precision flashcard
• [2–5 min] Add one safe-fixture writing tip
• [2–5 min] Add one severity-labeling tip
• [2–5 min] Add one MCP config review use case
• [2–5 min] Add one false-negative reporting tip
• [2–5 min] Add one false-positive reporting tip
• [2–5 min] Add one benchmark FAQ answer
• [2–5 min] Add one local repository scan use case
• [2–5 min] Add one pull-request scanning use case
• [2–5 min] Add one Claude Code review use case
• [2–5 min] Add one Agent Skill review use case
• [2–5 min] Add one recall flashcard
• [2–5 min] Add one static-vs-dynamic analysis flashcard
• [2–5 min] Add one secrets-handling flashcard
• [2–5 min] Add one static-only safety flashcard
• [2–5 min] Add one rule ID flashcard
• [2–5 min] Add one CI security gate flashcard
• [2–5 min] Add one Code Scanning flashcard
• [2–5 min] Add one GitHub Action flashcard
• [2–5 min] Add one flashcard about zero dependencies
• [2–5 min] Define least privilege for beginners
• [2–5 min] Define remediation for beginners
• [2–5 min] Define security severity levels
• [2–5 min] Define recall for beginners
• [2–5 min] Define precision for beginners
• [2–5 min] Define false negative for beginners
• [2–5 min] Define false positive for beginners
• [2–5 min] Define SARIF for beginners
• Add detection for suspicious PowerShell download-and-execute patterns
• Add a compact README demo GIF or terminal screenshot

style-dictionary/style-dictionary

• [Docs] Auto-generate types and enums docs from file contents

gramps-project/gramps-web

• Feature request: Provide the ability in Grampsweb to change the genealogical symbols

nextcloud/forms

• Replace description fields with NcRichText

Kaycee276/Chesster

• [FRONTEND] feat(frontend): Implement Dark/Light Mode Theme Toggle with System Auto-Detection
• [FRONTEND] feat(frontend): Add Token Wager Amount Selector Pills (1, 5, 10, 25, 50 XLM)
• [FRONTEND] feat(frontend): Implement Keyboard Shortcuts for Game Actions (Z=Undo, F=Flip, Space=Focus)
• [FRONTEND] feat(frontend): Add Share Match Link QR Code Generator in Game Lobby
• [FRONTEND] feat(frontend): Implement Player Account Balance Display in Navbar
• [FRONTEND] feat(frontend): Add Accessible Screen Reader Labels & ARIA Roles across Board
• [TESTING] test(frontend): Zustand Store State Transition Tests for Game, Wallet, and Toasts
• [TESTING] test(frontend): Sound Service Audio Synthesizer Mock Unit Tests
• [SECURITY] security(backend): Implement Sanitized SQL Query Parameterization Across All Models
• [SECURITY] security(frontend): Implement Strict XSS Sanitization on In-Game Chat Messages
• [SECURITY] security(backend): Enforce HTTPS and Secure WSS WebSocket Protocol in Production
• [SECURITY] security(frontend): Audit Wallet Private Key Isolation & Never Expose Secrets
• [SECURITY] security(backend): Implement IP Rate Limiter on Match Creation to Prevent Lobby Flooding
• [DOCS] docs(api): Add Swagger / OpenAPI Documentation for Backend REST Endpoints

AgentPostmortem/Ctxtrim

• Unreadable files silently reported as clean 0-token source
• merge() duplicates the managed block when a file has START without END
• Passing a file path silently scans the cwd instead of erroring

EISSeuropa/EISSeuropa.github.io

• EISS 2025 programme lists the same poster session on both days
• Declare what each Nunjucks partial expects

ChulioZ/spielwirbel

• Add the Portuguese UI locale (pt)

SecureBananaLabs/bug-bounty

• upload endpoint accepts empty file submissions as successful uploads
• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• registerUser access token can reference a different user id
• Job validation should reject inverted budget ranges
• Technical Poem Generation and Content Creation
• Pixel Art Creation with high Creative Thinking
• auth refresh endpoint issues tokens without verifying the requester
• User creation endpoint has no input validation
• Low Handing Fruit Automation
• Automate Bug Detection and Reviews
• Implement a fully functional Admin Panel
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Implement Secure Payment Gateway and Payment Service
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Proposal creation accepts records missing estimated duration
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Registration token subject can drift from returned user id
• fix: prevent admin role self-assignment during registration
• Bug: Refresh endpoint mints tokens without validating a refresh token
• fix(auth): prevent admin role self-assignment during registration
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation
• fix: prevent admin role self-assignment
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Payment endpoint lacks authentication — unauthenticated payment creation
• Bug: user creation accepts empty payloads and client-controlled ids
• Bug: registerUser signs token with a different generated user id
• Bug: Rate limiter should count malformed JSON before body parsing
• fix: prevent admin role self-assignment
• CORS configured without origin allowlist in app.js (reissue via #743)
• POST /api/users endpoint missing authentication middleware (reissue via #743)
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• Registration should require fullName to match User model
• @freelanceflow/db package should expose an importable workspace entrypoint
• Job creation endpoint lacks authentication — anyone can post jobs