Be decent. Assume the other person is trying to help.
Discuss the work, not the person. A design can be wrong, a commit can be careless, a test can be missing — say so plainly, about the thing rather than about whoever made it.
Disagree with reasons. "This will break under a concurrent write" is useful. "This is bad" is not.
Accept that someone may be right. Several decisions in this repository exist because a test or a reviewer contradicted the original plan, and the history records that rather than hiding it.
Take security reports seriously and privately. See SECURITY.md.
Harassment, personal attacks, discriminatory remarks, or sustained disruption. Publishing anyone's private information. Deliberately wasting a maintainer's time.
This applies in issues, pull requests, commit messages, and anywhere else this project is being discussed on behalf of the project.
This is a single-maintainer project. Report a problem privately through GitHub's private reporting, which is the only private channel this repository has. Reports are handled by the maintainer, who will remove content, close threads, or block accounts as necessary.
If the problem is with the maintainer, saying so publicly in an issue is a legitimate option.