chore: make the community inbox a per-account block; ichava uses ichava@

templates/health/CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-[opensource@simtabi.com](mailto:opensource@simtabi.com).
+[{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}](mailto:{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}).
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

templates/health/CONTRIBUTING.md.tmpl

@@ -31,5 +31,5 @@ individual repositories may add project-specific instructions in their own
 
 ## Questions
 
-[opensource@simtabi.com](mailto:opensource@simtabi.com), or the issue tracker of
+[{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}](mailto:{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}), or the issue tracker of
 the repository concerned.

templates/health/ISSUE_TEMPLATE/config.yml.tmpl

@@ -5,4 +5,4 @@ contact_links:
     about: Never in a public issue. Email security@simtabi.com, as the security policy describes.
   - name: Ask a question or get help
     url: https://github.com/{{ORG}}/.github/blob/HEAD/SUPPORT.md
-    about: Where to get help, including opensource@simtabi.com for anything that does not fit an issue.
+    about: Where to get help, including {{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}} for anything that does not fit an issue.

templates/health/SECURITY.md.tmpl

@@ -8,7 +8,7 @@ Please do not report security vulnerabilities through public issues, discussions
 
 Email **[security@simtabi.com](mailto:security@simtabi.com)**. This address works for every repository, public or private.
 
-Use only that address for security reports. Other Simtabi addresses, such as `opensource@simtabi.com`, handle community mail, and a report sent to one of them may be delayed.
+Use only that address for security reports. Other Simtabi addresses, such as `{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}`, handle community mail, and a report sent to one of them may be delayed.
 
 Where a public repository has GitHub private vulnerability reporting enabled, you can also use the **Report a vulnerability** button on that repository's **Security** tab. Use it only if the button is present; private repositories do not support it, and email remains the fallback everywhere.{{#CHANNEL_EXTRA}}{{/CHANNEL_EXTRA}}
 

templates/health/SUPPORT.md.tmpl

@@ -8,7 +8,7 @@ first:
 2. **Issues** — for bugs and feature requests, open an issue on the relevant
    repository. Search existing issues first; use the issue templates when offered.
 3. **Email** — for anything that does not fit an issue tracker,
-   [opensource@simtabi.com](mailto:opensource@simtabi.com).
+   [{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}](mailto:{{#COMMUNITY_EMAIL}}opensource@simtabi.com{{/COMMUNITY_EMAIL}}).
 
 Please use repository issues rather than email for questions specific to an
 individual project — answers in the tracker help the next person too.

templates/health/orgs.json

@@ -75,18 +75,23 @@
         "SUBJECT": "the open-source projects in the [ichava](https://github.com/ichava) organization",
         "SCOPE": "in this organization",
         "CHANNEL_EXTRA": "\n\nEvery public, non-archived repository in this organization has private vulnerability reporting switched on, so the button is available on all of them.",
-        "EXTRA": "\n\nEvery package is pre-1.0. Report anything you find regardless; pre-1.0 is not a reason to stay quiet."
+        "EXTRA": "\n\nEvery package is pre-1.0. Report anything you find regardless; pre-1.0 is not a reason to stay quiet.",
+        "COMMUNITY_EMAIL": "ichava@simtabi.com"
       },
       "support": {
         "DOCS": "each package's own `docs/` tree",
-        "DOCS_EXTRA": ", starting with\n   [core's installation guide](https://github.com/ichava/core/blob/main/docs/installation.md).\n   Plain markdown, browseable on GitHub"
+        "DOCS_EXTRA": ", starting with\n   [core's installation guide](https://github.com/ichava/core/blob/main/docs/installation.md).\n   Plain markdown, browseable on GitHub",
+        "COMMUNITY_EMAIL": "ichava@simtabi.com"
+      },
+      "code_of_conduct": {
+        "COMMUNITY_EMAIL": "ichava@simtabi.com"
       },
-      "code_of_conduct": {},
       "contributing": "keep",
       "issue_bug": {},
       "issue_feature": {},
       "issue_config": {
-        "ORG": "ichava"
+        "ORG": "ichava",
+        "COMMUNITY_EMAIL": "ichava@simtabi.com"
       },
       "pull_request": {}
     },

templates/health/tokens.md

@@ -57,15 +57,19 @@ They use their own inboxes.
 
 | Master | Tokens | Notes |
 |---|---|---|
-| `SECURITY.md.tmpl` | `{{SUBJECT}}`, `{{SCOPE}}`, `{{EXTRA}}`; block `CHANNEL_EXTRA` | `{{SUBJECT}}` completes "Simtabi LLC maintains …" and names the account with a link; `{{SCOPE}}` is `in this organization` or `on this account`; `{{EXTRA}}` closes the Scope section and `CHANNEL_EXTRA` follows the private-reporting paragraph, each starting with a blank line when set. Paragraphs are one line each, unwrapped. The fixed text carries the 5 / 15 / 30 business-day targets, 90-day coordinated disclosure, safe harbor and no bounty; it is not legal advice, so have it read before changing those sections |
-| `SUPPORT.md.tmpl` | `{{DOCS_EXTRA}}`; blocks `HELP`, `DOCS`, `EXCEPTION_JOIN` | an account with its own support prose replaces the whole `HELP` block |
-| `CONTRIBUTING.md.tmpl` | `{{ORG_LABEL}}` | only the heading varies; an account with its own guide is `"keep"` |
-| `CODE_OF_CONDUCT.md` | none | Contributor Covenant 2.1, enforcement `opensource@simtabi.com` |
+| `SECURITY.md.tmpl` | `{{SUBJECT}}`, `{{SCOPE}}`, `{{EXTRA}}`; blocks `CHANNEL_EXTRA`, `COMMUNITY_EMAIL` | `{{SUBJECT}}` completes "Simtabi LLC maintains …" and names the account with a link; `{{SCOPE}}` is `in this organization` or `on this account`; `{{EXTRA}}` closes the Scope section and `CHANNEL_EXTRA` follows the private-reporting paragraph, each starting with a blank line when set. Paragraphs are one line each, unwrapped. The fixed text carries the 5 / 15 / 30 business-day targets, 90-day coordinated disclosure, safe harbor and no bounty; it is not legal advice, so have it read before changing those sections |
+| `SUPPORT.md.tmpl` | `{{DOCS_EXTRA}}`; blocks `HELP`, `DOCS`, `EXCEPTION_JOIN`, `COMMUNITY_EMAIL` | an account with its own support prose replaces the whole `HELP` block |
+| `CONTRIBUTING.md.tmpl` | `{{ORG_LABEL}}`; block `COMMUNITY_EMAIL` | only the heading varies; an account with its own guide is `"keep"` |
+| `CODE_OF_CONDUCT.md` | block `COMMUNITY_EMAIL` | Contributor Covenant 2.1, enforcement at the community address |
 | `ISSUE_TEMPLATE/bug_report.yml.tmpl` | blocks `ENV_LABEL`, `ENV_PLACEHOLDER` | the environment field; laranail asks for the PHP / Laravel version |
 | `ISSUE_TEMPLATE/feature_request.yml.tmpl` | none | |
-| `ISSUE_TEMPLATE/config.yml.tmpl` | `{{ORG}}` | links the account's security policy page and its `SUPPORT.md`. Never Discussions: it is enabled on some repositories only, and an org default cannot tell which |
+| `ISSUE_TEMPLATE/config.yml.tmpl` | `{{ORG}}`; block `COMMUNITY_EMAIL` | links the account's security policy page and its `SUPPORT.md`. Never Discussions: it is enabled on some repositories only, and an org default cannot tell which |
 | `PULL_REQUEST_TEMPLATE.md.tmpl` | none | |
 
+`COMMUNITY_EMAIL` is the account's community and contact inbox, defaulting to `opensource@simtabi.com`.
+ichava sets `ichava@simtabi.com` (Sim, 2026-11-03). Disclosure is `security@simtabi.com` for every
+account and is not a token.
+
 `{{#NAME}}default{{/NAME}}` is a block with a default: the master's text unless the account sets
 `NAME`. In `orgs.json`, `"keep"` means the account's own file is the source and is never rendered;
 `"none"` means the account carries no such file by design.