OWASP BLT is an OWASP Foundation project, and everyone who takes part in it follows the OWASP Code of Conduct. That covers the forge at git.owaspblt.org (issues, pull requests, discussions, reviews and comments), the OWASP Slack channels, BLT sites, events, GSoC work, and any other place you represent the project.
In short: be respectful and professional, assume good faith, welcome newcomers, keep criticism about the work rather than the person, and don't harass, threaten or discriminate against anyone.
Honest disclosure of AI use is part of conduct here. Hiding AI use, or claiming None in a pull request's
AI model field when that isn't true, is treated as a conduct issue. See the
AI Policy.
- Within BLT spaces: contact the project leaders listed in GOVERNANCE.md privately (for example a direct message on the OWASP Slack). Don't raise conduct reports in a public issue.
- Serious or Foundation-level concerns, or concerns about a project leader: follow the OWASP Code of Conduct's reporting process, which goes through the OWASP Whistleblower and Anti-Retaliation Policy to a Compliance Officer or the Executive Director.
Maintainers may hide or remove comments, close issues and pull requests, or block accounts on git.owaspblt.org that break this code. Sanctions beyond the project are decided by OWASP under its own policy.
Some project folders (for example blt-legacy/ and blt-owasp-wich/) carry an older Contributor Covenant file
from their standalone repositories. Across the monorepo, the OWASP Code of Conduct applies.