Add RFC 9116 security.txt to static/.well-known/

[kobihikri]

What this does

Adds /.well-known/security.txt to the site by placing it in static/.well-known/security.txt, which Hugo copies verbatim to the published site root.

Why

RFC 9116 defines a small, standard file at /.well-known/security.txt so a security researcher can find where to report a vulnerability without guessing. Right now the live file is missing:

$ curl -sSL -o /dev/null -w '%{http_code}\n' https://valkey.io/.well-known/security.txt
404

The project already has a security contact — I just pointed the file at the existing mailbox and policy rather than inventing anything:

• Contact: mailto:security@lists.valkey.io (from SECURITY.md in this repo)
• Policy: https://github.com/valkey-io/valkey/security/policy
• Expires: — RFC 9116 requires this field; I set it ~1 year out.

Verifying it will serve

static/ is already served verbatim — for example static/img/IconGithub.svg is live at https://valkey.io/img/IconGithub.svg (200). Hugo copies dot-directories under static/ too, so static/.well-known/security.txt will publish at https://valkey.io/.well-known/security.txt. Please double-check on a preview build.

Single file, no other changes. Commit is DCO signed-off.

---

Disclosure: I used an AI tool to help spot this and draft the file. I verified every line myself against the live site and this repo's SECURITY.md, and I take responsibility for the change. Happy to adjust the Expires date, contact, or policy link to whatever the maintainers prefer.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39914799-b3b1-4a21-865d-a245749054b6

📥 Commits

Reviewing files that changed from the base of the PR and between 2e08e11 and 66e226d.

📒 Files selected for processing (1)

• static/.well-known/security.txt

---

📝 Walkthrough

Walkthrough

Changes

Security Metadata

Layer / File(s)	Summary
Security contact declaration static/.well-known/security.txt	Adds Valkey security contact, expiration, preferred language, canonical URL, and security policy metadata.

Suggested reviewers: stockholmux, madolson

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR adds a standard security contact file for the website. The main change is:

• New static/.well-known/security.txt with contact, expiry, canonical, language, and policy fields.

Confidence Score: 5/5

This looks safe to merge after checking the policy link target.

The static file is in the expected publish path, and the contact, expiry, language, and canonical fields look valid.

The policy field may point to a GitHub UI route instead of the direct policy document used elsewhere on the site.

T-Rex Logs

What T-Rex did

• T-Rex reviewed the repository state to confirm the security.txt setup and verified that the Zola blocker was in place before proceeding.
• T-Rex started the static server and captured the initial request/response exchange, including the observed HTTP headers and body.
• T-Rex performed integrity and content checks by computing the SHA-256 digest of the response and comparing it against the expected value, and by validating required fields in the response.
• T-Rex inspected the server access log to verify relevant access events and timings.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
static/.well-known/security.txt	Adds the RFC 9116 security contact file; the policy URL may need to match the site's existing direct policy link.

_{Reviews (1): Last reviewed commit: "Add RFC 9116 security.txt to static/.wel..." | Re-trigger Greptile}

[greptile-apps]

Policy Link Can Miss Document

If GitHub does not expose this repository's security policy through the /security/policy UI route, researchers following the published Policy field can land on a missing or generic page instead of the actual disclosure policy. The site already links its security policy directly to the repository SECURITY.md, so using that same target avoids a broken policy reference in security.txt.

[stockholmux]

1. This site isn't a Hugo site.
2. The static expiry seems like a silly thing to just forget to update. Use a template to make sure it always stays 1 year + last site build.