Elaborate code review process in CONTRIBUTING.md (#398)

Author: semioticrobotic

CONTRIBUTING.md

@@ -1,19 +1,19 @@
 # How to Contribute
-
-We'd love to accept your patches and contributions to this project. There are
-just a few small guidelines you need to follow.
+We'd love to accept your patches and contributions to this project.
+We just ask that you follow our contribution guidelines when you do.
 
 ## Contributor License Agreement
-
-Contributions to this project must be accompanied by a signed
-[Contributor Agreement](ContributorAgreement.txt).
-You (or your employer) retain the copyright to your contribution,
-this simply gives us permission to use and redistribute your contributions as
-part of the project.
+Contributions to this project must be accompanied by a signed [Contributor Agreement](ContributorAgreement.txt).
+You (or your employer) retain the copyright to your contribution; this simply grants us permission to use and redistribute your contributions as part of the project.
 
 ## Code reviews
+All submissions to this project—including submissions from project members—require review.
+Our review process typically involves performing unit tests, development tests, integration tests, and security scans using internal SAS infrastructure.
+For this reason, we don’t often merge pull requests directly from GitHub.
+
+Instead, we work with submissions internally first, vetting them to ensure they meet our security and quality standards.
+We’ll do our best to work with contributors in public issues and pull requests; however, to ensure our code meets our internal compliance standards, we may need to incorporate your submission into a solution we push ourselves.
 
-All submissions, including submissions by project members, require review. We
-use GitHub pull requests for this purpose. Consult
-[GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
-information on using pull requests.
+This does not mean we don’t value or appreciate your contribution.
+We simply need to review your code internally before merging it.
+We work to ensure all contributors receive appropriate recognition for their contributions, at least by acknowledging them in our release notes.