# Code of conduct

## Our standard

We collaborate with care because this project handles sensitive security,
privacy, and community information. Participants are expected to be respectful,
specific, evidence-minded, and willing to separate a person's dignity from a
technical disagreement.

Positive conduct includes:

- welcoming people of different backgrounds and experience;
- giving actionable review without ridicule or intimidation;
- disclosing uncertainty, mistakes, and conflicts of interest;
- protecting private and embargoed information;
- respecting authorized-testing, infrastructure-only, and anti-harassment
  boundaries; and
- accepting correction when wording or a feature could put users or third
  parties at risk.

Unacceptable conduct includes harassment, threats, discrimination, sexualized
attention, doxxing, stalking, sustained disruption, retaliation, publishing
private security reports, targeting people or equipment, or encouraging
unauthorized access or interference.

## Scope and enforcement

This code applies in repository spaces, community channels, project events,
private project communications, and when someone represents the project.

Report conduct concerns privately to a listed maintainer. If the concern
involves that maintainer, report it to another maintainer or the repository
owner. Do not include vulnerability details or unnecessary personal data.
Maintainers protect reporter privacy as far as practical, disclose conflicts,
and may warn, limit participation, remove content, suspend access, or ban a
participant based on severity and pattern. Credible immediate threats may be
escalated to the appropriate service or authority.

Enforcement decisions should document the violated standard, necessary
protective action, duration, and appeal path while minimizing personal data.
Good-faith security, privacy, safety, or moderation reports are protected from
retaliation. This policy does not require maintainers to host content that
violates the community intelligence safety boundary.