Add RFC 9116 security.txt to docs.defectdojo.com - #15737
Merged
Merged
Conversation
Serve /.well-known/security.txt from the docs site via Hugo's static dir. Points researchers at the HackerOne disclosure program and the published security policy. The Expires field is mandatory per RFC 9116 and needs an annual refresh; a reminder comment is baked into the file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
blakeaowens
approved these changes
Aug 19, 2026
Maffooch
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
/.well-known/security.txt(RFC 9116) to docs.defectdojo.com so security researchers can discover our disclosure channel mechanically. The file points at the HackerOne disclosure program and the SECURITY.md policy, matching the documented process.The file lives in
docs/static/.well-known/, so Hugo copies it to the site root and GitHub Pages serves it athttps://docs.defectdojo.com/.well-known/security.txtastext/plain. Note the docs deploy workflow (gh-pages.yml) triggers on pushes tobugfix/masterthat touchdocs/**, so this goes live when the PR merges; no manual publish step.Notes for review:
Expiresis mandatory per RFC 9116 and is set to2027-08-01T00:00:00Z(the RFC recommends keeping it under a year out). It needs an annual bump; a reminder comment is baked into the file itself.Canonicallistsdefectdojo.comfirst: the live marketing site 302s www to the apex, so the apex is the primary host. The www and docs URIs are also listed so retrieval from any of the three validates.Contactis HackerOne only. GitHub private vulnerability reporting is disabled on this repo (thesecurity/advisories/newURL would dead-end researchers), and SECURITY.md documents advisories as something maintainers create after HackerOne triage.Test results
public/.well-known/security.txtis emitted with the exact file content, i.e. the doks module mounts do copy the dot-directory fromstatic/.gh-pagesbranch already carries.nojekyll(added by peaceiris/actions-gh-pages), so GitHub Pages serves dot-directories as-is;fonts/andsvgs/from the samedocs/static/mount are already live on the deployed branch.Documentation
The added file is the deliverable; no docs content pages changed.
🤖 Generated with Claude Code