# Code of conduct

## Scope

This repository is a working tool for infrastructure operators. Discussion happens in issues, pull
requests and security advisories.

## Expected behaviour

- Argue from evidence: a command, an output, a version string, a path.
- Separate "this is wrong" from "this is not how I would do it".
- Assume the other person administers systems you cannot see.
- Keep credentials, addresses and customer names out of every message. Describe a host by its
  distribution, package versions and consumer list.
- Accept that a maintainer may decline a change that would weaken an invariant.

## Unacceptable behaviour

- Publishing another operator's infrastructure details, logs with personal data, or credentials.
- Harassment, personal attacks, or dismissive comments about someone's competence.
- Pressing for a change that removes the backup step, the authenticity gate or the verification
  because "it is faster".
- Sharing exploit material for hosts that are not yours to test.

## Enforcement

Report a problem to the maintainer through the repository's private advisory channel or by opening
an issue that names no third party. The maintainer may edit or remove a contribution, and may block
a participant for repeated violations.

## Attribution

This code follows the spirit of the
[Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/) and
adds the two rules this domain needs: evidence over opinion, and no infrastructure details in public
threads.