Code of conduct · BSides Dehradun 0x03

The short version

Be the sort of person other people are glad turned up. Treat everyone here as a colleague whose time and dignity are worth as much as your own. Do not harass anyone. If someone tells you to stop, stop.

The whole thing in one sentence

This is a conference about breaking systems, and the systems in scope are the ones on the tables, never the people in the room.

Who this applies to

Everyone, everywhere the conference happens. Attendees, speakers, workshop leads, village runners, capture-the-flag players, volunteers, sponsor staff, press and the organising team are all held to the same text. Being on the programme, wearing a volunteer badge or paying for a sponsorship tier buys nobody an exemption, if anything, standing at the front of a room raises the bar rather than lowering it.

It applies for the full two days at UPES Bidholi Campus, Dehradun, in every room and corridor the conference uses, at anything we organise alongside it, and in the online spaces listed under online spaces.

By attending, you agree to it. There is nothing to sign; turning up is the agreement.

What we expect

A code of conduct that only lists prohibitions describes a room nobody would want to be in. So, first, the behaviour that actually makes a conference worth travelling for:

Assume competence, and assume good faith

The person asking a basic question may know a great deal about something else. The person who got a detail wrong on stage is probably not lying to you.
Answer the question that was asked

Correcting someone is fine and often useful. Correcting someone in order to be seen correcting them is not the same activity.
Leave room in the conversation

Especially in the villages, especially with students, and especially if you have been doing this for fifteen years.
Respect the word no

About a photograph, a conversation, a hug, a handshake, a business card, a lift into town. No is a complete answer and does not require a reason.
Look after the space

Mind the kit on the village tables, mind the people trying to get past you in a corridor, and mind the volunteers, who have been on their feet since before you arrived.
Speak up

If you see something going wrong, you are allowed to say so, to the person, or to us. Bystanders who say something are the single most effective safety mechanism any conference has.

What is not acceptable

The following will be treated as a conduct violation. The list is not exhaustive, and nothing on it depends on whether you intended harm.

Harassment, intimidation or discrimination on the basis of gender, gender identity or expression, sexual orientation, caste, religion, ethnicity, nationality, language, region, disability, physical appearance, age, body size, or level of experience.
Unwelcome sexual attention, sexualised comments, sexual imagery in talks or slides, and deliberate physical contact after being asked to stop.
Sustained disruption of a talk, workshop, village or any other session, including heckling and using audience question time as a platform.
Following, stalking, photographing or recording someone who has asked you not to, on-site or afterwards.
Publishing someone's private information, or anything that identifies them, without their consent, including a screenshot of a conversation, a badge or a laptop screen.
Threats of violence, incitement, and advocating for or encouraging any of the above.
Retaliation against anyone who reports an incident, is named in a report, or helps us look into one.
Deliberate misgendering, or continuing to use a name or pronoun after being told the right one.
Repeated attempts to argue that any of the above does not apply to you.

Note on the two arguments we hear most. "It was a joke" is not a defence, because the effect on the person on the receiving end is identical. Neither is "this is a security conference", which is an argument that our field should be worse at this than every other field, and we do not accept it.

Hacking, hardware and the network

This is a conference where breaking things is the point, so it needs to be exact about where the boundary sits. The boundary is consent.

In scope

The equipment set out for you on the village tables, the targets provided by the capture the flag, and your own devices.

Not in scope

Other people's laptops, phones, badges and accounts; the venue's networks and systems; the conference's own infrastructure, ticketing and website; and anything belonging to a sponsor, a speaker or the university unless they have explicitly invited you to test it.

Attacking the conference Wi-Fi, intercepting other attendees' traffic, planting devices, or interfering with radio in a way that affects other people's sessions are all conduct violations rather than clever pranks. So is running a scan "just to see".

If you find a genuine vulnerability in the site, the ticketing flow or the CTF platform, we would honestly like to know. Tell us at conference@bsidesdehradun.com and give us a chance to fix it before you talk about it. That is the same address our security.txt gives, so a scanner and a person are told the same thing. Reporting in good faith is never treated as a violation.

Handling other people's hardware: ask first, and put it back where you found it. Village kit is frequently owned personally by the person running the village, and lending it to four hundred strangers is an act of trust.

Photography and recording

Ask before you photograph or record an identifiable person, and accept the answer. This holds for group shots where one person is clearly the subject, for the villages, and for anything you are planning to post.

Wide shots of a full room, a stage or the venue may be taken by the organising team and by press for use in conference material. If you would prefer not to appear in those, tell us at the registration desk and we will work around you.

Talks may be recorded. No recording of a talk is published without the speaker agreeing to it. Audience questions may be audible in a recording, so if you would rather not be, come and ask your question afterwards instead. That is always a legitimate choice, not a lesser one.

Do not photograph anyone's screen, badge, notebook or work in progress without asking. In this field that is not a neutral act.

Reporting an incident

If something happens to you, or you see something happen to somebody else, please tell us. You do not need to be certain, you do not need to have evidence, and you do not need to have decided what you want done about it.

Reporting contact

conference@bsidesdehradun.com

By email, any time. This address is read by the founding team and the team leads rather than by everyone with an organiser badge, and past them a report goes only to the people handling it. Say as much or as little as you want to.

To one person instead. If writing to a shared mailbox is the reason you would rather not write at all, ak@bsidesdehradun.com reaches the founder and lead organiser, and nobody else. It is slower, because it is one person with a day job. And if the only address you remember is info@bsidesdehradun.com, use that. Nothing is lost by picking the wrong one.

In person, during the event. Come to the registration desk and ask for the organiser on conduct duty, or speak to any member of the organising team. They will get you to the right person and they will not ask you to explain yourself in a corridor.

On-site contact and mobile number To be confirmed
A named person and a number you can call or message during the weekend will be published here, and printed on the back of every badge, before tickets go on sale. We are not going to put a placeholder name in a document that people may need in a hurry.

What is useful, if you have it: what happened, roughly when and where, who was involved, whether anyone else saw it, and whether you feel safe right now. If all you can manage is "something happened and I want to talk to someone", send that.

In an emergency, or if anyone is in immediate danger, contact the venue's security or the local emergency services first, and tell us afterwards. Our process is not a substitute for either.

What happens next

You are owed a clear account of what happens after you report, so here it is.

We listen, and we believe you to begin with

Nobody is asked to prove that they were harmed before being taken seriously. You will not be cross-examined and you will not be asked what you were wearing.
We ask what you want

Sometimes that is a formal response. Sometimes it is somebody quietly having a word, being walked to your taxi, or simply having it on record in case it happens again. All three are valid outcomes and the choice is yours wherever it can be.
We keep it to the people who need it

A report is shared only with the organisers handling it. Your name is not passed to the person you reported without your agreement, unless we cannot act at all otherwise, and we will tell you before that happens, not after.
Anyone with a conflict steps out

If a report concerns an organiser, a speaker they invited, or someone they work with, they take no part in handling it and are not told the details.
We tell you what we did

Not necessarily every detail about another person, but you will not be left wondering whether anything happened.
We do not publish incident details

Not in a wrap-up post, not in a talk, not as an anecdote.

During the event we aim to respond the same day; a report that arrives while the conference is running is dealt with while the conference is running. Outside the event, expect an acknowledgement within a few days.

Consequences

What we do depends on what happened, and it is a judgement made by people rather than a tariff. The range is:

A conversation, and a clear request to change something.
A formal warning, on record for this edition and future ones.
Being asked to leave a room, a village or a session.
Removal from the conference without a refund, and, for speakers and village runners, removal from the programme.
A ban from future editions of Security BSides Dehradun.
Where a sponsor's staff are involved, escalation to that organisation, and where the law is involved, referral to it.

We can also act without a formal report if we see something ourselves, and we can act on the balance of what we know rather than waiting for certainty. The organising team's decision on a conduct matter is final.

Reports made in bad faith, to settle a score, or to get somebody removed for reasons that have nothing to do with this document, are themselves a violation. This paragraph exists for completeness. It is not a warning, and it should not give anybody with a real report a moment's hesitation.

Online spaces

The same text applies in the conference's own online spaces: the accounts we post from, any chat server we run, the capture-the-flag platform while it is running, including the online qualifying round on 5–6 March 2027, and any repository we publish. It applies before the event and it applies afterwards, a conversation that starts in a village and continues in someone's inbox has not left the conference.

What we do not claim is jurisdiction over the whole internet. We are not going to adjudicate an argument that happened somewhere else between two people who happen to both be coming. We will, however, take seriously anything that gives us reason to think somebody would be unsafe at the event.

About this document

Security BSides Dehradun is an independent, volunteer-run event held under the Security BSides framework, and this code of conduct is our own. It draws on the anti-harassment policies the wider BSides and open-source conference community has developed over the years, which is to say that very little of the thinking here is original. That is the point of a norm.

It will be revised. If you think something here is unclear, missing, or would not survive contact with a real incident, write to info@bsidesdehradun.com and say so. That is a genuinely useful thing to receive.

Version 1.0 · Last updated 26 August 2026 · Applies to 0x03, 3–4 April 2027. The version in force is always the one published on this page.

One rule, and then the footnotes that make it usable.