diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 292f948..2904a24 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,27 +1,138 @@ -# Code of Conduct +# Contributor Covenant Code of Conduct -## Our standard +## Our Pledge -Everyone participating here — in issues, pull requests, reviews and -discussion — is expected to be respectful, direct and honest. Disagree with -the work, not the person. Report what you measured, including when it is -worse than expected. Assume competence; ask before assuming intent. +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. -## Unacceptable +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. -Harassment, personal attacks, discriminatory language, publishing others' -private information, and sustained disruption of discussion. So is passing -off a guess as a measurement — this repository's whole subject is the -difference. +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. ## Enforcement -Report conduct concerns to the maintainers through the address in -`SECURITY.md` (the same route, deliberately: one door). Reports are handled -privately. Maintainers may edit, remove or refuse contributions and -participation that do not meet this standard. +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +michael@flashygroup.com. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. ## Attribution -Adapted in spirit from the Contributor Covenant, shortened to what this -repository needs. +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations + +--- + +This file is emitted by `tools/estate-hygiene-files.mjs` in +[AgenteLabs/flashyos](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) for AgenteLabs/agentpay; `--check` fails +when it drifts. Regenerate it; never edit it here. diff --git a/SECURITY.md b/SECURITY.md index 90cb9ab..1dee9b8 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,12 +1,59 @@ + # Security -## Reporting +## Reporting a vulnerability -Report suspected vulnerabilities to **security@flashylabs** (address to be -confirmed before launch — until it is, a private report to the repository -owner is the route) rather than a public issue. Coordinated disclosure: we -acknowledge, we keep you updated, and we agree a window before anything is -published. +Report it privately, never in a public issue, pull request or chat channel. +Two routes, and both reach the same people: + +- **Email michael@flashygroup.com** — the estate's one disclosure address, the same one + published at https://flashynetwork.com/security/ + and in https://flashynetwork.com/.well-known/security.txt. + One route across every repository is deliberate: a researcher who finds two + addresses and picks the worse one has been failed by us, not by their choice. +- **GitHub → Security → Report a vulnerability** on this repository, which + opens a private advisory only the maintainers can read. If that button is + missing, private vulnerability reporting has not been enabled on this + repository yet; use the email route and say so in the report. + +Include what you found, how to reproduce it and what you believe the impact +is. Do not include real credentials, private keys or production data: nothing +here needs them to reproduce a finding. + +## What to expect + +| | | +|---|---| +| Acknowledgement | within 72 hours | +| An assessment, and what we are doing | agreed with you, in writing | +| Publication | a window agreed with you, never imposed | + +If we miss the acknowledgement window, say so publicly. A window nobody is +held to is worse than none, because it asks a reporter to wait on a promise +that was never load-bearing. + +## Supported versions + +The default branch only. There is no maintained release line behind it: a +finding against the default branch is in scope, a finding against an older +tag or a fork is a reason to update. + +## A committed credential is rotated, never removed + +If a report is that a secret reached this repository, the fix is rotation at +the issuer. Deleting the file, rewriting history or force-pushing is not a +fix: the value is burned the moment it lands and stays burned, because +history, forks, caches and mirrors keep it. Say which secret, and we rotate +it before anything else. + +## About this document + +The sections above are emitted by [`tools/estate-hygiene-files.mjs`](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) +in AgenteLabs/flashyos from one template the whole estate shares, and +`--check` fails when they drift. +Regenerate them; never edit them here. Anything below the marker is this +repository's own and is kept as written. + ## Scope @@ -31,8 +78,3 @@ Anything that makes the answer lie: Something the evaluator refuses that a rail then pays anyway is a finding about the rail, not this repository — but tell us, because it may mean the decision shape is easy to misread. - -## Supported versions - -There is no published version yet. Status: draft. Findings against the -default branch are in scope.