From 5f9dcf9a9b19ef06ecdddbc1d2bda4f8e0c3d1aa Mon Sep 17 00:00:00 2001 From: Damon Blais Date: Mon, 14 Sep 2026 08:51:22 -0700 Subject: [PATCH] docs: add org community health defaults (SECURITY, SUPPORT, CONTRIBUTING, CoC) --- CODE_OF_CONDUCT.md | 125 +++++++++++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 39 ++++++++++++++ README.md | 22 ++++++++ SECURITY.md | 52 +++++++++++++++++++ SUPPORT.md | 25 +++++++++ 5 files changed, 263 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 README.md create mode 100644 SECURITY.md create mode 100644 SUPPORT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..b0a4260 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,125 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment include: + +- Demonstrating empathy and kindness toward other people +- Being respectful of differing opinions, viewpoints, and experiences +- Giving and gracefully accepting constructive feedback +- Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +- Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +- The use of sexualized language or imagery, and sexual attention or advances of + any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information, such as a physical or email address, + without their explicit permission +- Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces for Rethunk-AI +projects, and also applies when an individual is officially representing the +community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +[oss@rethunk.ai](mailto:oss@rethunk.ai). + +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the +[Contributor Covenant](https://www.contributor-covenant.org), version 2.1, +available at +https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity). + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..f208472 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing + +Thanks for considering a contribution to [Rethunk-AI](https://github.com/Rethunk-AI). +This is the **organization default**. If a repository ships its own +`CONTRIBUTING.md` (or `HUMANS.md` / `AGENTS.md`), follow those first. + +## Ground rules + +- Be respectful — see [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). +- Keep changes focused: one logical unit per PR when practical. +- Prefer fixing docs and tests alongside behavior changes. +- Do not commit secrets, credentials, or private customer data. + +## Commits + +Use [Conventional Commits](https://www.conventionalcommits.org/): + +```text +type(scope): subject +``` + +Common types: `feat`, `fix`, `docs`, `refactor`, `test`, `ci`, `build`, `chore`. +The body should explain **why**, not restate the diff. + +## Pull requests + +1. Branch from the repository default branch (`main` unless noted). +2. Run the project's documented checks (CI, `lefthook`, `gate`, etc.) before asking for review. +3. Describe: what changed, why, how you tested, and any deliberate tradeoffs. +4. Link related issues. + +## Security + +Report vulnerabilities privately — see [`SECURITY.md`](SECURITY.md). + +## Questions + +- Project-specific: open an issue on that repo +- Org / process: [oss@rethunk.ai](mailto:oss@rethunk.ai) or see [`SUPPORT.md`](SUPPORT.md) diff --git a/README.md b/README.md new file mode 100644 index 0000000..f8c4979 --- /dev/null +++ b/README.md @@ -0,0 +1,22 @@ +# Rethunk-AI organization templates + +Organization-level GitHub configuration for [Rethunk-AI](https://github.com/Rethunk-AI). +Houses the public org profile and default community health files used when a +repository does not define its own. + +## Contents + +| Path | Purpose | +|------|---------| +| [`profile/README.md`](profile/README.md) | Public organization profile on github.com/Rethunk-AI | +| [`SECURITY.md`](SECURITY.md) | Default vulnerability reporting policy | +| [`SUPPORT.md`](SUPPORT.md) | Where to ask for help | +| [`CONTRIBUTING.md`](CONTRIBUTING.md) | Default contribution expectations | +| [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) | Community standards | + +Repo-specific docs (for example `bakeoff`'s `SECURITY.md` / `CONTRIBUTING.md`) +override these defaults when present. + +## License + +Organization template content © Rethunk.AI / Rethunk.Tech, LLC. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..7c0ff87 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,52 @@ +# Security Policy + +This is the **organization default** for [Rethunk-AI](https://github.com/Rethunk-AI). +If a repository has its own `SECURITY.md`, follow that file instead. + +## Supported versions + +Unless a repo says otherwise, only the default branch (`main`) is supported. +Security fixes land there; there is typically no long-lived release branch. + +## Reporting a vulnerability + +**Do not open a public issue** for security-sensitive findings. + +1. Prefer GitHub's private advisory flow on the affected repository: + `https://github.com/Rethunk-AI//security/advisories/new` +2. If that is unavailable, email [oss@rethunk.ai](mailto:oss@rethunk.ai) with + **[SECURITY]** in the subject. + +Please include: + +- Affected repository and commit SHA (or release tag) +- Reproduction steps +- Observed vs. expected behavior +- Impact assessment (local-only, requires credentials, remote exploitability, etc.) + +We aim to acknowledge reports within a few business days. + +## Scope guidance + +**Usually in scope** + +- Remote or local code execution reachable through project code or config +- Credential or secret leakage via logs, artifacts, or docs +- Supply-chain issues in first-party packaging or release signing we control +- Authz / sandbox bypasses in agent tooling we publish + +**Usually out of scope** + +- Issues that require already having root or physical access to the host +- Bugs solely in upstream dependencies without a demonstrable path through our code + (report those upstream; link us if relevant) +- Denial of service from intentional oversized local workloads (resource sizing) +- Social-engineering of individual maintainers outside published channels + +## Safe harbor + +We will not pursue legal action against good-faith research that: + +- Avoids violating privacy, destroying data, or degrading production services +- Stops at proof of concept without exfiltrating unrelated user data +- Gives us a reasonable chance to remediate before public disclosure diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..b7e3eec --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,25 @@ +# Support + +This is the **organization default** for [Rethunk-AI](https://github.com/Rethunk-AI). +Prefer a repository's own docs when they exist. + +## How to get help + +| Need | Where | +|------|--------| +| Bug or feature for a specific project | Open an issue on that repository | +| Security vulnerability | See [`SECURITY.md`](SECURITY.md) — do **not** file a public issue | +| Community / Discord questions | [discord-docs](https://github.com/Rethunk-AI/discord-docs) | +| Org / OSS contact | [oss@rethunk.ai](mailto:oss@rethunk.ai) | + +## Before opening an issue + +1. Check the repo `README` (and `HUMANS.md` / `AGENTS.md` if present). +2. Search existing issues and discussions for duplicates. +3. Include OS, versions, exact commands, and minimal reproduction when reporting bugs. + +## What we do not offer here + +- Private consulting or custom implementation work via GitHub Issues +- Guaranteed SLAs on volunteer / OSS response times +- Support for archived repositories (see the org profile "Prior art" section)