# Code of Conduct

**Be Excellent to Each Other.**

This Code of Conduct establishes expectations for participation in the PassFX community. We are building software that protects people's most sensitive data. The standards for how we treat each other should be no less rigorous than the standards for how we treat their secrets.

---

## Table of Contents

1. [Our Pledge](#our-pledge)
2. [Our Standards](#our-standards)
3. [Unacceptable Behavior](#unacceptable-behavior)
4. [Scope](#scope)
5. [Enforcement Responsibilities](#enforcement-responsibilities)
6. [Reporting Violations](#reporting-violations)
7. [Enforcement Guidelines](#enforcement-guidelines)
8. [Attribution](#attribution)

---

## Our Pledge

We pledge to make participation in the PassFX community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.

We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.

We are all here because we care about security, privacy, and writing good software. Some of us have been programming since punch cards. Some of us just merged our first pull request. Both perspectives matter. Both belong here.

Remember: everyone was once the person who did not know what PBKDF2 stood for. Treat newcomers the way you wish someone had treated you.

---

## Our Standards

A healthy community does not happen by accident. It requires intention, respect, and the occasional deep breath before hitting "send" on a comment.

### Expected Behavior

**Be respectful.** Disagreement is inevitable in technical work. Disagreement does not require disrespect. Critique the code, not the coder. You can point out that a pull request has issues without implying the author is incompetent.

**Be constructive.** If you identify a problem, try to suggest a solution. "This approach has timing attack vulnerabilities" is more useful than "This is wrong." "Consider using `secrets.compare_digest()` for constant-time comparison" is more useful still.

**Be collaborative.** Open source works because people with different skills contribute to shared goals. The person reviewing your code is not your adversary. The person whose code you are reviewing is not your student. We are colleagues working toward the same objective: software that protects users.

**Be patient.** Not everyone communicates the same way. English is not everyone's first language. Written text lacks tone. Assume good intent until proven otherwise. If a comment seems harsh, consider whether it might just be terse.

**Be honest.** If you do not know something, say so. If you made a mistake, acknowledge it. Pretending expertise you lack helps no one. Admitting gaps in knowledge creates opportunities for everyone to learn.

**Be welcoming.** New contributors bring fresh perspectives. Answer questions with the understanding that today's question-asker is tomorrow's maintainer. A community that makes people feel stupid for asking questions eventually runs out of people willing to ask.

### In Practice

- Use clear, professional language
- Acknowledge contributions and give credit where due
- Accept feedback gracefully and provide it kindly
- Respect people's time by doing your homework before asking questions
- Remember that behind every GitHub handle is a human being

---

## Unacceptable Behavior

Some behaviors are incompatible with a healthy community. These are not acceptable under any circumstances.

### Harassment

- Sexual language, imagery, or unwanted advances
- Deliberate intimidation, stalking, or following
- Sustained disruption of discussions or events
- Unwelcome physical contact or simulated physical contact in virtual spaces

### Discrimination

- Derogatory comments related to gender, gender identity, sexual orientation, disability, mental illness, neurodivergence, physical appearance, body size, age, race, ethnicity, nationality, or religion
- Deliberately using incorrect pronouns or names
- Creating an environment where members of particular groups feel unwelcome or unsafe

### Personal Attacks

- Public or private insults
- Name-calling or ad hominem arguments
- Attacking someone's competence, intelligence, or character
- Responding to technical disagreements with personal criticism

### Trolling and Bad Faith

- Deliberate provocation or inflammatory comments
- Sealioning (persistent, bad-faith questioning under the guise of seeking information)
- Derailing discussions with off-topic or intentionally divisive content
- Weaponizing the Code of Conduct by filing frivolous or malicious reports

### Privacy Violations

- Publishing private information without explicit permission (doxxing)
- Sharing private communications without consent
- Recording or screenshotting private discussions for public exposure

### Threats and Intimidation

- Threats of violence, harm, or legal action used as intimidation
- Encouraging others to engage in harmful behavior
- Implicit threats through references to physical location, employer, or personal information

### Harmful Advocacy

- Advocating for or encouraging any of the above behaviors
- Defending unacceptable behavior as "just a joke" or "not that serious"
- Retaliation against those who report violations

---

## Scope

This Code of Conduct applies in all PassFX community spaces and when representing the project in public.

### Where It Applies

- GitHub Issues, Pull Requests, and Discussions
- Project documentation and comments in code
- Official communication channels (Discord, mailing lists, if established)
- Social media when speaking on behalf of the project
- Conferences, meetups, or events where you represent PassFX
- Private communications related to project participation

### Representing the Project

You are representing PassFX when you:

- Use an official project email address
- Post via official project social media accounts
- Act as an appointed representative at events
- Are identified as a project maintainer or contributor in a relevant context

In short: if a reasonable observer would associate your behavior with PassFX, this Code of Conduct applies.

---

## Enforcement Responsibilities

Project maintainers are responsible for clarifying and enforcing our standards. This is not a power we take lightly.

### Maintainer Commitments

Maintainers will:

- Clarify standards when questions arise
- Take appropriate and fair corrective action in response to violations
- Remove, edit, or reject contributions that violate this Code of Conduct
- Communicate reasons for moderation decisions when appropriate
- Protect the privacy of reporters and those accused
- Act consistently and without favoritism

### Maintainer Limitations

Maintainers will not:

- Use enforcement powers for personal disputes unrelated to the project
- Publicly disclose private reports without consent
- Retaliate against anyone for filing a good-faith report
- Apply different standards based on personal relationships

Maintainers who violate the Code of Conduct are subject to the same enforcement guidelines as anyone else.

### Current Maintainers

- **@dinesh-git17** - Project Lead

---

## Reporting Violations

If you experience or witness behavior that violates this Code of Conduct, please report it. We take all reports seriously.

### How to Report

**Email:** conduct@dineshd.dev

Include in your report:

- Your contact information (so we can follow up)
- Names or handles of those involved
- Description of the behavior
- When and where it occurred
- Any relevant context or documentation (screenshots, links)
- Whether you prefer to remain anonymous to the accused

### What Happens Next

1. **Acknowledgment.** You will receive confirmation within 48 hours that we received your report.

2. **Investigation.** We will review the report, gather additional context if needed, and consult relevant parties. This typically takes 5-10 business days for complex cases.

3. **Decision.** We will determine what action, if any, is appropriate based on the Enforcement Guidelines below.

4. **Communication.** We will inform you of our decision and the general reasoning behind it. Details may be limited to protect privacy.

### Confidentiality

All reports are treated confidentially. We will not disclose the identity of reporters without explicit consent, except as required by law or to protect someone from imminent harm.

If you are uncomfortable reporting to the current maintainers for any reason, we understand. In that case, please reach out to a neutral third party you trust who can mediate.

### What We Cannot Do

We cannot adjudicate disputes outside our community spaces. We cannot compel behavior on other platforms. We cannot provide legal advice or intervention. We are volunteers maintaining open source software, not a court of law.

---

## Enforcement Guidelines

When violations occur, we respond proportionally. Our goal is correction, not punishment. However, we will not hesitate to act decisively when community safety requires it.

### Level 1: Correction

**Appropriate for:** First-time minor violations, accidental insensitivity, misunderstandings.

**Action:** A private, written message explaining the nature of the violation and why the behavior was inappropriate. An expectation of change going forward.

**Example:** A contributor makes a dismissive comment about another's code quality. They receive a private message explaining how to provide constructive feedback instead.

### Level 2: Warning

**Appropriate for:** Repeated minor violations after correction, or a single more serious violation.

**Action:** A formal warning with specified consequences for continued behavior. May include a temporary restriction from interacting with certain community members or spaces.

**Example:** After correction, a contributor continues to make condescending comments in code reviews. They receive a warning that further behavior will result in a temporary ban.

### Level 3: Temporary Ban

**Appropriate for:** Serious violations, or continued behavior after warning.

**Action:** Temporary ban from all community interaction for a specified period (typically 7-90 days, depending on severity). No public or private interaction with community members during this period.

**Example:** A contributor engages in targeted harassment of another member. They are temporarily banned for 30 days.

### Level 4: Permanent Ban

**Appropriate for:** Demonstrated pattern of violations, egregious single violations, or violations that endanger community members.

**Action:** Permanent removal from all community spaces. No future participation permitted.

**Example:** A contributor doxxes another member or makes credible threats. They are permanently banned.

### Factors We Consider

- Severity and impact of the violation
- Whether the behavior was intentional or accidental
- History of previous violations
- Whether the violator acknowledges and takes responsibility
- Risk of future harm
- Impact on the affected parties

### Appeals

If you believe a decision was made in error, you may appeal by emailing the project lead with additional context or mitigating information. Appeals are reviewed by someone not involved in the original decision when possible.

---

## Attribution

This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

We have customized this document to reflect the values and culture of the PassFX project: a community that takes security seriously, welcomes contributors at all levels, and believes that building good software requires treating people well.

### A Note on Enforcement

A Code of Conduct is only as good as its enforcement. We are committed to applying these standards consistently and fairly. If you ever feel that we have fallen short of that commitment, please tell us.

Open source communities thrive when everyone feels safe to contribute. We intend to maintain that safety.

---

*Document maintained by the PassFX project maintainers.*
*Last updated: December 2025.*
