Contributing to Velocity

Velocity is not open source yet. This page says exactly what that leaves open to an outside contributor, which is a shorter list than most projects but not an empty one.

What is open now

These docs

The documentation repository is public, and it is the only Velocity codebase open to pull requests. Raise an issue or open a PR at velocity-docs.

The most valuable report is a disagreement with the program. If a page states a constant, a formula, an error code, or a mechanism, and the deployed program does something else, that is a bug and we want it reported like one: name the page, quote the sentence, and say what was observed. Typos and broken links are welcome too, they are just cheaper to find.

Before writing anything longer than a line, read WRITING.md in the repository root. It fixes the register, the vocabulary (which terms are load-bearing and must not be swapped), and the shape a page takes. A pull request that follows it merges much faster than one that does not.

The published SDKs, as a consumer

@velocity-exchange/sdk is on npm at 0.20.0, and @velocity-exchange/vaults-sdk is there too, though its published version trails the monorepo. Both are available to build against. The source is not public, so bug reports against SDK behavior go through the docs repository until it is: include the package version, the call, and the program error or wrong value it returned.

What is not open yet

The velocity-v1 monorepo is not public. That covers the onchain program, the vaults program, the SDK source, the JIT proxy client, and the reference keeper bots.

It will be published once the post-fork audit report is final. Until then, code contributions to any of those components are not possible from outside the team, and every path these docs quote inside the monorepo (programs/velocity, apps/keeper-bots-v2, and the rest) names a location that cannot be browsed yet. There is no mirror, no partial release, and no source link to ask for.

For access before publication, whether for an integration or for an independent audit, contact the team directly.

What we will want when it opens

Listed so the work is visible in advance, not as an invitation to start before publication.

There is no Python SDK. The Rust client (velocity-rs, in a separate rust/ workspace alongside keep-rs and swift) is source-only and not on crates.io, so it has to be built from source. @velocity-exchange/jit-proxy is published to npm, so the JIT client does not need monorepo access.

Reporting a vulnerability

Security issues do not go through any of the above, and must not be filed as a public issue. See Bug Bounty for scope, severity tiers, and how to submit privately.