diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index fd23e04..ae0b292 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,24 +1,138 @@ -# Code of conduct +# Contributor Covenant Code of Conduct -Everyone who reads, corrects or discusses this map is expected to do so with the same care the map asks of itself: say what you measured, say how you know, and treat the people on the other side of an issue as colleagues. +## Our Pledge -## Expected +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. -- Correct the map with evidence, and accept a correction to your correction the same way. -- Disagree about what is true; do not disagree about who somebody is. -- Assume a wrong status is stale rather than dishonest, and say so if you find it is the second. -- Keep private things private: a repo marked `private` on the map is not a target for guessing at its contents in the open. +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. -## Not accepted +## Our Standards -- Harassment, personal attacks, or discriminatory language of any kind, in issues, pull requests, commits or anywhere the repository's name appears. -- Publishing somebody else's private information — contact details, credentials, internal hostnames — whether or not it looks harmless. -- Inventing a figure or a status and presenting it as measured. +Examples of behavior that contributes to a positive environment for our +community include: -## Enforcement +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities -Maintainers may edit, hide or remove content that breaks these rules and may decline further contributions from anybody who breaks them repeatedly. Reports go to the contact in `SECURITY.md`, with the same caveat that file carries about the address being confirmed; a report about a maintainer goes to the accountable contact named in the estate's mesh handshake instead. +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. ## Scope -This applies in every space this repository owns — issues, pull requests, discussions and commit history — and to anybody representing it elsewhere. +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +michael@flashygroup.com. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations + +--- + +This file is emitted by `tools/estate-hygiene-files.mjs` in +[AgenteLabs/flashyos](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) for AgenteLabs/web4; `--check` fails +when it drifts. Regenerate it; never edit it here. diff --git a/SECURITY.md b/SECURITY.md index 7290b06..574f89e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,24 +1,69 @@ + # Security -This repository holds no code that runs in production, serves no surface, and stores no data: it is a map of the Web 4 stack. A security issue here is one of two things, and each goes to a different place. +## Reporting a vulnerability -## A vulnerability in a protocol or product on the map +Report it privately, never in a public issue, pull request or chat channel. +Two routes, and both reach the same people: -Report it to that repository's owners, not here. The map names the repo for every layer (`stack.md`); the protocol's own `SECURITY.md` says how to reach them. If a repo is private and you cannot see its policy, use the address below and say which layer you mean — we will route it. +- **Email michael@flashygroup.com** — the estate's one disclosure address, the same one + published at https://flashynetwork.com/security/ + and in https://flashynetwork.com/.well-known/security.txt. + One route across every repository is deliberate: a researcher who finds two + addresses and picks the worse one has been failed by us, not by their choice. +- **GitHub → Security → Report a vulnerability** on this repository, which + opens a private advisory only the maintainers can read. If that button is + missing, private vulnerability reporting has not been enabled on this + repository yet; use the email route and say so in the report. -## A problem with this repository +Include what you found, how to reproduce it and what you believe the impact +is. Do not include real credentials, private keys or production data: nothing +here needs them to reproduce a finding. -A map can mislead. If the map claims a repo is public, launched, or conformant when it is not — or names a well-known surface that is not served — that is a correctness issue, and a `map correction` issue is the right form for it. Nothing in this repository is secret, so a correction can be filed in the open. +## What to expect + +| | | +|---|---| +| Acknowledgement | within 72 hours | +| An assessment, and what we are doing | agreed with you, in writing | +| Publication | a window agreed with you, never imposed | + +If we miss the acknowledgement window, say so publicly. A window nobody is +held to is worse than none, because it asks a reporter to wait on a promise +that was never load-bearing. + +## Supported versions + +The default branch only. There is no maintained release line behind it: a +finding against the default branch is in scope, a finding against an older +tag or a fork is a reason to update. -If you believe something here leaks information it should not (a credential, an internal hostname, a person's contact that was not meant to be published), do not file it in the open. Email the address below. +## A committed credential is rotated, never removed -## Contact +If a report is that a secret reached this repository, the fix is rotation at +the issuer. Deleting the file, rewriting history or force-pushing is not a +fix: the value is burned the moment it lands and stays burned, because +history, forks, caches and mirrors keep it. Say which secret, and we rotate +it before anything else. -**security@flashylabs** — to be confirmed. This address is written down as the estate's intended security contact and has not yet been verified as monitored from this repository. Until it is confirmed here, a report that receives no acknowledgement within seven days should be re-sent to the accountable contact named in the estate's mesh handshake (`/.well-known/flashyos.json` on any live estate property carries an `accountableTo`). +## About this document -## What we will do +The sections above are emitted by [`tools/estate-hygiene-files.mjs`](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) +in AgenteLabs/flashyos from one template the whole estate shares, and +`--check` fails when they drift. +Regenerate them; never edit them here. Anything below the marker is this +repository's own and is kept as written. + + +## A vulnerability in a protocol or product on the map + +Report it to that repository's owners, not here. The map names the repo for every layer (`stack.md`); the protocol's own `SECURITY.md` says how to reach them. If a repo is private and you cannot see its policy, use the address above and say which layer you mean — we will route it. + +## A problem with this repository + +A map can mislead. If the map claims a repo is public, launched, or conformant when it is not — or names a well-known surface that is not served — that is a correctness issue, and a `map correction` issue is the right form for it. Nothing in this repository is secret, so a correction can be filed in the open. -Acknowledge within seven days. Fix a map error by correcting the map and moving the status date. Fix a leak by removing the content and treating anything that was a credential as burned — removal is not rotation, and the estate's rule is that a committed secret stays burned after the file is deleted. +If you believe something here leaks information it should not (a credential, an internal hostname, a person's contact that was not meant to be published), do not file it in the open. Email the address above. ## Scope of this repository's own tests