Chain-Risk is an open-source community focused on software supply-chain security and dependency risk analysis. We are committed to providing a welcoming, respectful, and professional environment for everyone, regardless of experience, background, identity, or level of participation.
We expect community members to act in good faith, communicate constructively, and prioritize the safety and well-being of the community.
Examples of behaviour that contributes to a positive environment include:
- Being respectful, considerate, and constructive.
- Welcoming questions and differing technical opinions.
- Giving and receiving feedback professionally.
- Focusing criticism on ideas, code, and evidence rather than individuals.
- Acknowledging mistakes and correcting them responsibly.
- Respecting privacy and handling security-sensitive information carefully.
- Giving credit for others' work and respecting licenses and attribution.
- Disclosing conflicts of interest relevant to project decisions.
Examples include:
- Harassment, intimidation, discrimination, or personal attacks.
- Trolling, insults, sustained disruption, or deliberately hostile conduct.
- Publishing another person's private information without permission.
- Threats, stalking, or unwanted sexual attention.
- Impersonation, deceptive attribution, or knowingly misrepresenting review or security status.
- Deliberately exposing secrets, private vulnerability details, or sensitive user data.
- Retaliation against someone who raises a concern in good faith.
- Any other conduct that is inappropriate in a professional open-source community.
This Code applies in Chain-Risk organization repositories, issue trackers, pull requests, discussions, project events, and other spaces where a person is representing or participating in the Chain-Risk community.
Report conduct that violates this Code privately to the organization maintainers through the Chain-Risk GitHub organization: https://github.com/Chain-Risk
Do not use a public issue to report sensitive personal information. For security vulnerabilities, follow SECURITY.md, not this reporting process.
Maintainers will review reports as fairly and promptly as reasonably possible, respecting the privacy of people involved. They may seek clarification, remove harmful content, issue a warning, restrict participation, or remove a person from project spaces depending on severity and context.
Maintainers should document significant enforcement decisions and avoid retaliation. A maintainer who is directly involved in a report should not be the sole decision-maker for that report.
People asked to stop unacceptable behaviour are expected to comply immediately. Maintainers may take action without a prior warning when necessary to protect community members or project security.
A person affected by an enforcement decision may request reconsideration from the organization owners, provided the request does not expose another person's private information or create further harm.
This Code of Conduct is an original policy for the Chain-Risk community. It is informed by common open-source community practices and should be reviewed as the community and its needs evolve.