Initial write-up for member audit

docs/member-auditing.md

@@ -0,0 +1,28 @@
+# Jupyter Organization Member Auditing
+
+This document proposes a new security policy concerning member activity within our GitHub organizations.
+The Jupyter Security Council aims to routinely review the activity levels of members across our GitHub organizations.
+Members who have not engaged in any activity for a specific period will have their privileges adjusted or may be removed from the organization. This process aims to to enhance security by ensuring that only active contributors retain access. GitHub privileges do not indicate membership or status within the Jupyter project, this policy aims to support the Jupyter project's overall security efforts.
+
+## Scope
+
+This process applies to *all projects* governed by Jupyter (including those under other organizations) such as: JupyterLab, Jupyter Notebook, Jupyter Server and JupyterHub.
+
+## Defining Inactivity
+
+A member is considered inactive if they have not performed any *public* [GitHub events](https://docs.github.com/en/rest/activity/events?apiVersion=2022-11-28#list-public-events-for-a-user) within the last [365] days. Some examples of those public activities include:
+
+- Commits to public repositories
+- Pull requests to public repositoryies
+- Participating in issues or pull requests
+    - Applying or managing labels on issues or pull requests
+
+## Communication and Feedback
+
+We understand that contributors may have varying levels of engagement due to numerous factors. Our goal is to implement this policy without disrupting workflows or discouraging contributions.
+We will reach out to maintainers and members identified as inactive to discuss their status before making any changes. This ensures that we only adjust privileges for those who have truly been inactive.
+We invite all maintainers, contributors and users to [share your thoughts or concerns](https://jupyter.org/security#community-reshttps://github.com/jupyter/security/issues/99) regarding this policy. Your feedback is valuable as we refine our approach to best support the Jupyter community.
+
+## Reinstatement of Access
+
+If a member's privileges are adjusted due to inactivity, they can be reinstated upon request. Our goal is to maintain security without hindering future contributions.