An open source project is made of code, but it lives through people writing to each other in public, often without knowing one another, from different countries and cultures, sometimes under pressure. In this context misunderstandings are inevitable, and hostile behaviour, when it occurs, drives away precisely the most valuable contributors. A code of conduct is the tool a community uses to state what it expects and, above all, what happens when those expectations are not met.
What it is really for
A code of conduct does not magically make people kind. Its value is practical:
- it makes rules explicit: newcomers know what is acceptable without having to guess;
- it provides a reporting channel: people who experience misconduct know whom to turn to;
- it protects moderators: when they have to step in, they rely on known rules rather than personal judgement;
- it signals care: many people decide whether to contribute partly based on the presence of clear rules.
The most common weakness is not the text but the lack of an enforcement mechanism. A code with no contact address and no designated people is just a statement of intent.
What it should contain
Many projects adopt an existing, widely used template such as the Contributor Covenant and adapt it. Whether you start from a template or from scratch, an effective code covers at least these points:
- Scope: where it applies (issues, pull requests, chat, mailing lists, events, accounts representing the project).
- Expected behaviour: respect, criticism aimed at ideas rather than people, willingness to accept feedback.
- Unacceptable behaviour: insults, harassment, personal attacks, publishing other people's private information, discriminatory language.
- How to report: an email address or a form, stating who receives it.
- Confidentiality: an assurance that the reporter's identity will be protected.
- Consequences: a scale of proportionate measures.
- Conflicts of interest: what happens if the report concerns a moderator.
The scale of measures
Having a scale defined in advance avoids disproportionate reactions or, conversely, inaction. A common structure:
| Level | Example of behaviour | Typical measure |
|---|---|---|
| Correction | A single rude comment | Private reminder and request to change tone |
| Warning | Repeated behaviour after a reminder | Formal warning with explicit consequences |
| Temporary ban | Serious or persistent violation | Exclusion for a defined period |
| Permanent ban | Harassment, threats, severe violations | Removal from all project spaces |
You do not have to go through every level: serious behaviour can justify immediate exclusion.
Handling a report
When a report arrives, an orderly process reduces mistakes and tension:
- Acknowledge receipt to the reporter promptly.
- Gather the facts: links to messages, context, any witnesses. It is wise to save copies, because messages can be edited or deleted.
- Exclude conflicts: anyone involved or close to the parties does not take part in the decision.
- Hear the reported person, when doing so does not put the reporter at risk.
- Document the decision, referring to the rule that was broken.
- Communicate with the parties privately, with the minimum necessary detail.
Decisions are not debated publicly in the project's threads. If the community needs to be informed, it is enough to say that action has been taken, without exposing anyone.
Who should moderate
In small projects moderators are often the maintainers themselves. That works, but there should be at least two, so that a report about one can be handled by the other. In projects under a foundation there may be a central committee that steps in for the most delicate cases.
Moderation is tiring and not very visible. It should be recognised as a contribution on a par with code, and those who do it must be able to step back without feeling guilty.
Mistakes to avoid
- Publishing the code with no contact: nobody will know how to use it.
- Applying it only to strangers: the rules also apply to long-standing contributors and to maintainers.
- Reacting publicly in the heat of the moment: it fuels conflict and makes a calm decision harder.
- Ignoring reports: silence tells everyone the code is decorative.
In short
- A code of conduct makes rules explicit and offers a channel for reports.
- It must state scope, behaviour, contact, confidentiality and proportionate consequences.
- Reports should be handled through an orderly, documented and confidential process.
- You need at least two moderators and rules that apply to everyone, maintainers included.
