Hugh Lashbrooke

Product manager by day, tabletop game designer by night.

The Five Principles: Safety

This post is part of a series looking at what I believe to be the five key principles for creating long-lasting community connections at scale. You can read all of the posts in this series in this archive.

The first of the five principles for creating community connections at scale is safety – people will struggle to really engage unless they feel safe in your community. This includes safety of all types – physical, mental, social, emotional, etc.

You need to ask yourself…what can I do to make sure my community members feel safe?

Safety may feel like a relatively basic thing to ensure, but it’s surprisingly easy to overlook, especially when you, as the community manager, don’t struggle with the same safety issues as members of your community. You need to ask yourself – what potential dangers can members of my community face, and what can I do to mitigate those factors? What can I do to make sure my community members feel safe?

There are several things you can do here on many different levels, and they all build upon each other, so let’s start at the beginning:

Code of Conduct

The most essential thing you can do to create a sense of safety for your community members is to have a published code of conduct. It doesn’t have to be overly thorough, nor does it have to cover every scenario or edge case – what it does need to be is clear, unequivocal, and backed by empathy.

As you set these expectations for how people should behave in your community, you’ll discover that two things will be able to happen. Firstly, people will have a greater understanding of what your community is about and how they should be interacting within it and secondly, newcomers to the community will immediately feel safer as they will be able to see that you take their safety seriously. The upshot of this is that you will be able to see greater growth, retention and engagement across the board.

It may feel like a daunting prospect to begin writing a code of conduct, so here are some tips to help you get started:

Start with a simple statement

Figure out the core of what you want safety to look like in your community and write that down as a plain statement. Here’s a really simple example:

In this community, we treat everyone with respect, courtesy and empathy.

Sure, there isn’t a lot of nuance to that statement, and it certainly doesn’t cover specific behaviours or interactions, but it immediately sets the tone for how people should engage with each other. This is instantly better than having no code of conduct at all.

You can take this further by identifying fundamental interactions that take place in your community and codifying how people should be a part of them:

In this community, we treat everyone with respect, courtesy and empathy. Refrain from demeaning, discriminatory or harassing behaviour and speech.

We’re already off to a great start here! Having just that on its own will be a boon to the feeling of safety in your community.

Review examples from other communities

As you dive deeper into what your community’s code of conduct should look like, you can review those of other communities and, assuming they don’t mind, copy the language that you find to be the most effective. Here’s the code of conduct from Learn WordPress, the educational community in which I am currently working – feel free to copy as much of it as you like. I also really like these ones from Creative Commons, ZA Tech, Ministry of Testing and CodeBase.

To make things even easier for you, there are several open-source codes of conduct that you can make use of (and regular readers will know how passionate I am about open-source). The Contributor Covenant is a wonderful place to start, as is the Open Source Guide. These can really help you to hit the ground running with your own code of conduct, so I would encourage you to make use of them.


Confidential Incident Reporting

Something you will notice from all of the codes of conduct I linked above is that they include a way to report violations and incidents securely and confidentially. This is a vital component that accompanies any good code of conduct or behaviour policy. If people are unable to report issues, then the policy will always be ineffectual and that feeling of safety that you’re cultivating will likely never come to fruition.

A step further from confidential reporting is to provide a channel for anonymous reporting. This will make an even bigger impact as there can be many instances where someone might not be comfortable reporting something under their own name. Fortunately this is really easy to set up – all you need is a standard form with optional fields for name and email address. The WordCamp program does this well – any reports submitted land in a confidential inbox and taken seriously whether they are anonymous or not.


Dedicated & Trained Response Team

While an incident reporting system is essential to have in place, it’s not going to be too effective without a team dedicated to responding to the reports. For a small community, that “team” might just be you as the sole community manager, and that’s OK! You have to start somewhere, but since we’re talking about principles of scale here, let’s look at what this should look like for a larger community.

An incident response team should have a few key features:

  • Diverse composition – i.e. members from different genders and cultural backgrounds
  • Highly curated membership
  • Training for all members on how to respond to reports
  • Public list of members for transparency

You can use any method you like for selecting members – direct outreach, open applications, etc. – but ultimately, if you focus on those features then you will be moving in a positive direction. It’s OK to be selective here – you only want people on this team who you believe will be able to respond with empathy and have the strength to follow through on the stipulations in your code of conduct. That being said, don’t make the mistake of only selecting people like you – you need to ensure diverse representation in order to provide fair and balanced responses to incident reports.

Regardless of who is on the team, providing some form of training for them is vital – this could be as simple as running them through your protocols over a video call, or documenting those protocols for them, or it could be a more robust training course that all members are required to work through. By way of example, the training that all members of the incident response team for the WordPress community must take is filled with policy details, practical guides, and case studies to ensure that they are fully prepared to fulfil their duties. To help you get started, you can feel free to copy some or all of those training materials under the terms of the CC BY-SA 4.0 licence.

Making the members of the incident response team known to your community is vital. People need to know who will be reading their incident reports – this provides an even greater feeling of safety, and may encourage more detailed reports, as they know just who is going to be reading and responding.


Published Response Protocols

So you have a code of conduct, community members can submit anonymous reports, and you have a dedicated response team in place – the final stage in this master plan is to codify and publicly document your response protocols. If you created training materials for your response team, then you likely have much of this documentation already written, but since that will be harder to access for the average community member you need to provide greater clarity.

If people know what will happen when they submit a report, they are far more likely to actually submit it. If they don’t feel like you will respond effectively then there’s a good chance you’ll never hear from them and incidents will go unacknowledged. You don’t need to be overly thorough with this – after all, these types of incidents are rarely straight forward so being prescriptive at this stage is difficult, if not impossible – but what you do need to make clear is that you will respond to all reports and then give an idea of the types of responses that people may receive. Again, the WordPress incident response team has a great example of this – not only does it indicate what kind of responses people will receive, but it also lists the response team members, and the expected time frames for an initial response.

Pro tip: If your response protocols do not involve a process of “calling in” then I can highly recommend you look into that. My colleague Angela Jin published a short series of posts on what this looks like in practice.

As a bonus here, you can make this documentation even more effective by publishing reports on specific incidents that you have dealt with as a team. These would need to be anonymous and somewhat vague by necessity, but providing your community with information on what actually happened from an individual report is a powerful way of communicating that you take their safety seriously.


If you work through all of this you will be well on your way to cultivating a feeling of safety and security in your community.

If you work through all of this, set up your documentation, publish your protocols, select and train your team, and make sure you respond to reports effectively, you will be well on your way to cultivating a feeling of safety and security in your community. This will set you up for continued success as your community scales, and community members will find it far easier and more natural to create deeper and longer-lasting connections with others.

The next post in this series covers the second principle of support – read on!

Leave a Reply

Your email address will not be published. Required fields are marked *