Security policies, and code of conduct.

[savente93]

If you go into the Insights tab and look at community standards (or click this link https://github.com/Deltares/hydromt/community ) You can see that we do pretty well but there are a few points on which we are still not "up to spec". Most of these things in and of themselves don't have that much of an impact but do act as signals to the outside and open source community of a healthy projects. I think most of these won't but be a lot of work to setup/maintain we just need to discuss the proper avenue for them. I already made a start with #381 but there are three other things I think would be good for us to do:

• Choose a code of conduct
• Setup a security policy
• Allowing the reporting of content or behavior.

I'll go into a bit more detail for each of these

Choose a code of conduct

This one is fairly simple, there are several standard ones that are available which I think most or all of would be appropriate for us. This is mostly a signal to users rather than doing something for us. In addition to the last point, this one also requires that we open an avenue for reporting and responsible disclosure. Ideally this would not be a personal avenue (like someone's specific email adress) even if it's managed by only one person. Who and how this should do this is something we'll have to discuss but I doubt it will be a big problem.

Setup a security policy

Again, this one has several standard forms that we can choose from so it should not be very hard. It basically consists of two things: Maintaining an overview of versions that are actively maintained, and which of any versions that we published will continue to gain security updates (for our purposes that is the same thing), and again setup an avenue for responsible disclosure of security issues. I'll refer you to the previous section about this for the things that need to happen for this, as it's mostly the same.

Allowing the reporting of content or behavior.

Basically the same as the previous two, but an admin should also enable this in the GitHub repository.

I think this is a nice thing to do for our community, but there are some admin things that I am not authorised to do and am not really sure how they work within Deltares. I'm happy to deal with most of it, but I wanted to discuss it with everyone, as well as ask for help with the bits that I don't have permissions for. What do you think @alimeshgi @hboisgon @DirkEilander ?