TripleO source code is publicly available. You can contribute code to individual projects, documentation, report bugs and vulnerabilities, request features.
As long as TripleO is a set of integrated OpenStack projects, all development is happening in OpenStack upstream.
See TripleO Components to find out how to contribute into individual projects.
OpenStack Upstream: If you find bugs or vulnerabilities which affect upstream projects, please follow OpenStack’s process of filing bugs.
TripleO If the bug impacts the TripleO project as a whole, you can file a bug in Launchpad:
OpenStack Upstream: Since we are developing projects in OpenStack community, all the features are being requested upstream via Blueprints.