Creating Codeberg: Code of Conduct … check
as something to definitely be more clear about.
As for other requirements and malfeasance. Not particular creative this morning in thinking about this, but suppose a FEP by a government agency, say NSA, that constitutes backdooring apps to expose PII or recommending weakened security protocols / encryption. Guess that might be covered by the CoC, depending how it is formulated, but likely do not match the out-of-the-box templates. What are other requirements to take into account?