Code of conduct

Everyone, everywhere the conference happens. Attendees, speakers, trainers, village runners, capture-the-flag players, volunteers, sponsor staff, press and the organising team are all held to the same text.

Being on the programme, wearing a volunteer badge or paying for a sponsorship tier buys nobody an exemption. If anything, standing at the front of a room raises the bar rather than lowering it.

It applies for the full two days at a Dehradun venue, to be announced, in every room and corridor the conference uses, at anything we organise alongside it, including the trainings on 1–2 April, and in the online spaces listed below.

By attending, you agree to it. There is nothing to sign; turning up is the agreement.

A code of conduct that only lists prohibitions describes a room nobody would want to be in. So, first, the behaviour that makes a conference worth travelling for:

1. Assume competence, and assume good faith. The person asking a basic question may know a great deal about something else. The person who got a detail wrong on stage is probably not lying to you.
2. Answer the question that was asked. Correcting someone is fine and often useful. Correcting someone in order to be seen correcting them is not the same activity.
3. Leave room in the conversation. Especially in the villages, especially with students, and especially if you have been doing this for fifteen years.
4. Respect the word no. About a photograph, a conversation, a hug, a handshake, a business card, a lift into town. No is a complete answer and does not require a reason.
5. Look after the space. Mind the kit on the village tables, the people trying to get past you in a corridor, and the volunteers, who have been on their feet since before you arrived.
6. Speak up. If you see something going wrong, you are allowed to say so, to the person or to us. Bystanders who say something are the single most effective safety mechanism any conference has.

The following will be treated as a conduct violation. The list is not exhaustive, and nothing on it depends on whether you intended harm.

• Harassment, intimidation or discrimination on the basis of gender, gender identity or expression, sexual orientation, caste, religion, ethnicity, nationality, language, region, disability, physical appearance, age, body size, or level of experience.
• Unwelcome sexual attention, sexualised comments, sexual imagery in talks or slides, and deliberate physical contact after being asked to stop.
• Sustained disruption of a talk, training, village or any other session, including heckling and using audience question time as a platform.
• Following, stalking, photographing or recording someone who has asked you not to, on site or afterwards.
• Publishing someone's private information, or anything that identifies them, without their consent, including a screenshot of a conversation, a badge or a laptop screen.
• Threats of violence, incitement, and advocating for or encouraging any of the above.
• Retaliation against anyone who reports an incident, is named in a report, or helps us look into one.
• Deliberate misgendering, or continuing to use a name or pronoun after being told the right one.
• Repeated attempts to argue that any of the above does not apply to you.

The two arguments we hear most. "It was a joke" is not a defence, because the effect on the person on the receiving end is identical. Neither is "this is a security conference", which argues that our field should be worse at this than every other field. We do not accept it.

Breaking things is the point here, so the boundary needs to be exact. The boundary is consent.

In scope

The equipment set out for you on the village tables, the targets provided by the capture the flag, and your own devices.

Not in scope

Other people's laptops, phones, badges and accounts; the venue's networks and systems; the conference's own infrastructure, ticketing and website; and anything belonging to a sponsor, a speaker or the university unless they have explicitly invited you to test it.

Attacking the conference Wi-Fi, intercepting other attendees' traffic, planting devices, or interfering with radio in a way that affects other people's sessions are conduct violations, not clever pranks. So is running a scan "just to see".

If you find a genuine vulnerability in the site, the ticketing flow or the CTF platform, we would like to know. Tell us at [email protected] and give us a chance to fix it before you talk about it. That is the same address our security.txt gives, so a scanner and a person are told the same thing. Reporting in good faith is never treated as a violation.

Handling other people's hardware: ask first, and put it back where you found it. Village kit is often owned personally by the person running the village, and lending it to four hundred strangers is an act of trust.

Ask before you photograph or record an identifiable person, and accept the answer. This holds for group shots where one person is clearly the subject, for the villages, and for anything you plan to post.

Wide shots of a full room, a stage or the venue may be taken by the organising team and by press for conference material. If you would prefer not to appear in those, tell us at the registration desk and we will work around you.

Talks may be recorded. No recording of a talk is published without the speaker agreeing to it. Audience questions may be audible in a recording, so if you would rather not be, ask your question afterwards instead. That is always a legitimate choice, not a lesser one.

Do not photograph anyone's screen, badge, notebook or work in progress without asking. In this field that is not a neutral act.

You are owed a clear account of what happens after you report.

1. We listen, and we believe you to begin with. Nobody is asked to prove that they were harmed before being taken seriously. You will not be cross-examined and you will not be asked what you were wearing.
2. We ask what you want. Sometimes that is a formal response. Sometimes it is somebody quietly having a word, being walked to your taxi, or simply having it on record in case it happens again. All three are valid outcomes and the choice is yours wherever it can be.
3. We keep it to the people who need it. A report is shared only with the organisers handling it. Your name is not passed to the person you reported without your agreement, unless we cannot act at all otherwise, and we will tell you before that happens, not after.
4. Anyone with a conflict steps out. If a report concerns an organiser, a speaker they invited, or someone they work with, they take no part and are not told the details.
5. We tell you what we did. Not every detail about another person, but you will not be left wondering whether anything happened.
6. We do not publish incident details. Not in a wrap-up post, not in a talk, not as an anecdote.

During the event we aim to respond the same day; a report that arrives while the conference is running is dealt with while the conference is running. Outside the event, expect an acknowledgement within a few days.

What we do depends on what happened. It is a judgement made by people, not a tariff. The range is:

• A conversation, and a clear request to change something.
• A formal warning, on record for this edition and future ones.
• Being asked to leave a room, a village or a session.
• Removal from the conference without a refund and, for speakers and village runners, removal from the programme.
• A ban from future editions of Security BSides Dehradun.
• Where a sponsor's staff are involved, escalation to that organisation; where the law is involved, referral to it.

We can act without a formal report if we see something ourselves, and on the balance of what we know rather than waiting for certainty. The organising team's decision on a conduct matter is final.

Reports made in bad faith, to settle a score or to get somebody removed for reasons unrelated to this document, are themselves a violation. This paragraph exists for completeness. It is not a warning, and it should not give anybody with a real report a moment's hesitation.

The same text applies in the conference's own online spaces: the accounts we post from, any chat server we run, the capture-the-flag platform while it is running (including the online round on 17–18 February 2027), and any repository we publish. It applies before the event and it applies afterwards: a conversation that starts in a village and continues in someone's inbox has not left the conference.

We do not claim jurisdiction over the whole internet, and will not adjudicate an argument elsewhere between two people who are both coming. We will take seriously anything that suggests somebody would be unsafe at the event.

Security BSides Dehradun is an independent, volunteer-run event held under the Security BSides framework, and this code of conduct is our own. It draws on the anti-harassment policies the wider BSides and open-source conference community has developed over the years, which is to say that very little of the thinking here is original. That is the point of a norm.

It will be revised. If something here is unclear, missing, or would not survive a real incident, write to [email protected].

Version 1.0 · Last updated 26 August 2026 · Applies to 0x03, 3–4 April 2027. The version in force is always the one on this page.