From 512f2842df98067f230d1cb7ba14af05b82e76b6 Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Wed, 19 Aug 2026 12:26:21 -0600 Subject: [PATCH] Add RFC 9116 security.txt to docs.defectdojo.com Serve /.well-known/security.txt from the docs site via Hugo's static dir. Points researchers at the HackerOne disclosure program and the published security policy. The Expires field is mandatory per RFC 9116 and needs an annual refresh; a reminder comment is baked into the file. Co-Authored-By: Claude Fable 5 --- docs/static/.well-known/security.txt | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 docs/static/.well-known/security.txt diff --git a/docs/static/.well-known/security.txt b/docs/static/.well-known/security.txt new file mode 100644 index 00000000000..52ec137614d --- /dev/null +++ b/docs/static/.well-known/security.txt @@ -0,0 +1,21 @@ +# DefectDojo vulnerability disclosure information (RFC 9116) +# https://www.rfc-editor.org/rfc/rfc9116 + +# Report security issues through the DefectDojo HackerOne disclosure program +Contact: https://hackerone.com/defectdojo/reports/new + +# Coordinated disclosure policy and process +Policy: https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/SECURITY.md + +Preferred-Languages: en + +Canonical: https://defectdojo.com/.well-known/security.txt +Canonical: https://www.defectdojo.com/.well-known/security.txt +Canonical: https://docs.defectdojo.com/.well-known/security.txt + +# NOTE: RFC 9116 requires the Expires field; this file must be refreshed +# annually. Before the date below passes, bump Expires ~1 year ahead in BOTH +# copies of this file: +# - HubSpot File Manager copy served at defectdojo.com (theme repo: well-known/) +# - docs/static/.well-known/security.txt in django-DefectDojo (docs site) +Expires: 2027-08-01T00:00:00Z