# Code of Conduct

## The short version

Be straight with people and assume they are being straight with you. Criticise the code, the
design and the decision — never the person who wrote it. Say what you actually think, and say
it in a way the other person can act on.

## What is expected

- **Technical honesty.** If something is broken, say it is broken, and say what evidence you
  have. Overstating certainty wastes people's time; understating it hides real problems.
- **Specific criticism.** "This retries a non-idempotent call" is useful. "This is bad" is not.
- **Accepting correction.** Being wrong in public is the ordinary cost of working in the open.
  Nobody here is expected to be right the first time; everybody is expected to update.
- **Patience with beginners, not with carelessness.** A question that shows someone has not read
  the file they are changing deserves a pointer to it, kindly. A change that ignores a rule after
  it has been explained deserves a plain "no".

## What is not acceptable

- Personal attacks, demeaning remarks, or comments about someone's identity rather than their work.
- Harassment of any kind, in issues, pull requests, or private messages arising from this project.
- Deliberately wasting people's attention: bad-faith argument, repeated off-topic pressure,
  reopening a settled decision without new information.
- Publishing anyone's private information.

## Security research

Probing this software is welcome and useful. Probing **other people's servers** running it is
not, and no finding excuses it. Report privately as `SECURITY.md` describes; findings from
your own machines, and coordinated disclosure, are credited.

## Scope

This applies in the repository — issues, pull requests, discussions, commit messages — and to
private communication that starts here.

## Enforcement

Report to **security@innovayse.com**, marking the subject "conduct". That is the address this
project already monitors; a separate one will be published here when there is somebody separate
reading it, rather than published now and read by nobody.

Reports go to the maintainers at Innovayse LLC and are not shared further without your
agreement, except where the law requires it.

The response is proportionate and stated plainly: usually a private word, sometimes a public
correction, and for repeated or serious behaviour a block from the project. A maintainer who
breaks these rules is subject to them exactly as anyone else is — if that maintainer is the
person you would report to, write to the address above naming another one.