diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 30240d8..3724b20 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -6,7 +6,12 @@ # something to report that fits neither template should not be turned away by a # heading. # -# No contact links. A link here publishes a route to a person, and which address -# this repository publishes, for a vulnerability or for anything else, is entry 5 -# of #1 and is not decided. +# No contact links, and the reason is no longer that nothing is decided. Entry 5 +# of #1 was answered on 2026-09-04: the routes are GitHub's own, a private report +# on this repository and a message to the account that holds it, and no mailbox is +# published anywhere on this board. Both are named in `SECURITY.md` and in +# `CODE_OF_CONDUCT.md`, which is where a reporter who never opened the chooser +# finds them. A link here would be a second copy of a route, and a second copy is +# the thing that drifts against the first one and sends somebody to the older of +# the two. blank_issues_enabled: true diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a79ddc3 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,135 @@ +# Code of conduct + +## Who this covers, and where + +Everybody who takes part here: an issue, a pull request, a review, a commit +message, and a private message that started from one of those. It covers me too. +I hold this repository and I am inside these rules rather than above them, which +is the sentence that decides whether the rest of the document is worth reading. + +## What is expected + +Argue with the work. Everything else in this repository is built on that +already - a claim carries the command that produced it, a number carries its +run, and a disagreement is settled by executing something rather than by who +said it. `CONTRIBUTING.md` states that as a rule about evidence. Here it is the +same rule about people: the thing under discussion is a file, a measurement or a +decision, never the person who wrote it. + +Keep measured and assumed apart in the sentence. Being wrong in public is the +ordinary cost of working this way, and a correction is a repair rather than a +verdict on whoever needed it. Somebody who writes "I did not measure this" has +done the harder thing, not the weaker one. + +Take a refusal with its reason. A change sent back here comes back with what was +wrong, and disagreeing with that reason is fair. Reopening it unchanged in a +different place is not. + +## What is not acceptable + +- An attack on a person rather than on their work, including one dressed as a + question about their competence. +- Demeaning somebody for who they are, or for a group they belong to. +- Harassment, in the open or in messages that started here and continued + somewhere else. +- Publishing somebody's private details - a legal name, an address, an employer, + anything they did not put here themselves - without their consent. +- Unwanted attention of a sexual kind, and sexual material in any part of this + repository or its tracker. +- Sustained disruption: the same settled argument reopened without new evidence, + a thread derailed on purpose, a review answered with volume instead of + substance. +- Threatening any of the above, whether or not it is carried out. + +That list holds what has to be named, and it is a floor rather than a boundary. +Behaviour nobody wrote down is judged by the section above it, not permitted by +its absence from this one. Some of this repository's own gate rules are built the +same way, in `.github/invariants/rules`, where a register of names stands in for +a test of purpose and every run prints that bound beside its verdict. The same +disclosure is owed here. + +## Reporting + +Two routes, in this order. + +**A private report on this repository.** The form under Security is the only +private channel this repository has: + + https://github.com/Flowfin/core/security/advisories/new + +It is labelled for a vulnerability, because that is what it was built for. A +conduct report sent through it is not misfiled: it reaches the same person, it +is not public, and no part of it is published by submitting it. That the form +answers at all is a setting on the repository rather than a promise in a file, +so it is read rather than asserted: + + gh api repos/Flowfin/core/private-vulnerability-reporting + {"enabled":true} + +Run 2026-09-04. That reading needs administrative access to this repository, so +it is not one a reader of this board can run; what a reader can do is open the +address above and see whether the form is there. + +`SECURITY.md` names the same form for a vulnerability and is where a security +report belongs; the two documents point at one door on purpose, so there is no +second route to keep in step with this one. That file carries its own reading of +the same setting, taken earlier, answering `false`, and saying in its own words +that the destination was shut on the day it was read. The reading above is the +later of the two and was taken against the same repository. + +**A message through GitHub to the account that holds this repository**, which is +https://github.com/iderex. Use this where the first route does not fit - where +the report is about the form itself, or where you would rather it did not sit in +a security queue. + +Do not open an issue about a conduct problem. An issue here is public from the +moment it is submitted, and it names the person it is about to everybody, before +anybody has read it. + +No mailbox is published, here or anywhere else on this board. An address in a +document outlives whoever was reading it and stays in the history after it is +changed, and an address nobody watches is worse than none because the document +promises a reply. Both routes above are accounts on a service that already +authenticates the sender, and they need nothing kept alive to keep working. + +## What happens after a report arrives + +I read it, and I answer it. If something is missing I ask for it, and if I decide +it is not a problem you get the reason rather than silence. + +There is no deadline and there will not be one, for the reason `SECURITY.md` +gives about the other route: a window this project cannot hold is worse than +none, because a reporter left past it cannot tell a busy week from a report that +never arrived. + +What I can do is limited and worth stating exactly rather than implying more: ask +somebody to stop, edit or delete content on this repository, close or lock a +thread, block an account from this repository, and report an account to GitHub. +Nothing here reaches anybody outside this repository, and none of it is a +sanction anywhere else. + +Your name does not appear in whatever follows unless you ask for it to. Where +something has to be said in public, it is said about the behaviour and the +outcome. + +## Where this document is weak + +**One person holds it.** A report about my own behaviour comes to me, and there +is no second reader, no appeal and no independent body. That is the honest state +of a repository with one holder rather than an arrangement I am recommending, and +it is the reason the route below exists rather than being buried. GitHub's own +abuse route is not mine and does not go through me: + + https://github.com/contact/report-abuse + +**Nothing enforces this.** No check on this repository reads this file, and none +could: every gate leg here judges bytes in the tree, and how somebody spoke to +somebody else is not a byte in the tree. What stands behind this document is that +I do what it says, and the way to find out that I did not is to report it. A +document that looked enforced would be worse than this sentence. + +**It is not the Contributor Covenant**, and the difference is deliberate. That +document's enforcement section describes a body of people, a graduated ladder of +consequences and a review of appeals. None of those exists here, and publishing a +ladder nobody climbs would describe an apparatus this repository does not have - +which is the failure the paragraph above is written against.