diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 8375e2f..7e01db7 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,31 +1,138 @@ -# Code of Conduct +# Contributor Covenant Code of Conduct -This is a small repository with a narrow purpose, and its conduct rules are -correspondingly short. +## Our Pledge -## The standard +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. -- Be direct and be kind. Disagree with the work, not the person. -- Measure before you assert. Most disputes here are about whether a value is - true; the answer is a reading, not an opinion, and the person who measured - says what they measured and when. -- Report what happened, including when it is worse than expected. A wrong - entry corrected loudly is worth more than a right one nobody checked. -- No harassment, no discrimination, no personal attacks, no publishing of - anyone's private information. None of that is up for discussion. +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. ## Scope -Issues, pull requests, discussions and any other space where this repository -is being worked on, and any public space where someone is representing it. +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. ## Enforcement -Maintainers may edit, remove or refuse contributions and comments that break -this standard, and may block repeat offenders. Report a concern privately to -the address in `SECURITY.md`; it reaches the same people. +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +michael@flashygroup.com. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. ## Attribution -Written for this repository; it borrows the spirit of the Contributor Covenant -without adopting its text. +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations + +--- + +This file is emitted by `tools/estate-hygiene-files.mjs` in +[AgenteLabs/flashyos](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) for AgenteLabs/stack.json; `--check` fails +when it drifts. Regenerate it; never edit it here. diff --git a/SECURITY.md b/SECURITY.md index 8c393b3..8a08aca 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,22 +1,59 @@ + # Security -This repository holds a public index document, a JSON Schema and a -dependency-free checker. It runs no service, stores no data about anyone and -holds no credentials. The attack surface is the checker itself and the -truthfulness of the index. +## Reporting a vulnerability -## Reporting +Report it privately, never in a public issue, pull request or chat channel. +Two routes, and both reach the same people: -Please report a vulnerability privately, not in a public issue. +- **Email michael@flashygroup.com** — the estate's one disclosure address, the same one + published at https://flashynetwork.com/security/ + and in https://flashynetwork.com/.well-known/security.txt. + One route across every repository is deliberate: a researcher who finds two + addresses and picks the worse one has been failed by us, not by their choice. +- **GitHub → Security → Report a vulnerability** on this repository, which + opens a private advisory only the maintainers can read. If that button is + missing, private vulnerability reporting has not been enabled on this + repository yet; use the email route and say so in the report. -- Email: **security@flashylabs** — *to be confirmed at launch; until the - address is confirmed, a private report to the maintainers through GitHub's - "Report a vulnerability" on this repository reaches the same people.* -- Include what you found, how to reproduce it, and which commit or branch you - measured against. +Include what you found, how to reproduce it and what you believe the impact +is. Do not include real credentials, private keys or production data: nothing +here needs them to reproduce a finding. -You will get an acknowledgement, and we will say what we did — including when -it is worse than you reported. +## What to expect + +| | | +|---|---| +| Acknowledgement | within 72 hours | +| An assessment, and what we are doing | agreed with you, in writing | +| Publication | a window agreed with you, never imposed | + +If we miss the acknowledgement window, say so publicly. A window nobody is +held to is worse than none, because it asks a reporter to wait on a promise +that was never load-bearing. + +## Supported versions + +The default branch only. There is no maintained release line behind it: a +finding against the default branch is in scope, a finding against an older +tag or a fork is a reason to update. + +## A committed credential is rotated, never removed + +If a report is that a secret reached this repository, the fix is rotation at +the issuer. Deleting the file, rewriting history or force-pushing is not a +fix: the value is burned the moment it lands and stays burned, because +history, forks, caches and mirrors keep it. Say which secret, and we rotate +it before anything else. + +## About this document + +The sections above are emitted by [`tools/estate-hygiene-files.mjs`](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) +in AgenteLabs/flashyos from one template the whole estate shares, and +`--check` fails when they drift. +Regenerate them; never edit them here. Anything below the marker is this +repository's own and is kept as written. + ## What counts