security: add RFC 9116 security.txt + surface security policy links - #141
Merged
Conversation
- website/public/.well-known/security.txt: org-wide security contact (email + src-control GitHub advisories), Policy -> src-control SECURITY.md, Expires 2027-07-18, Canonical git-agentic.com. Astro serves public/ verbatim, so it lands at https://git-agentic.com/.well-known/security.txt. - Footer: add a 'Security' link to the security.txt (org-wide, every page). - src-control page Docs line: add Threat model + Security (SECURITY.md) links, reflecting that src-control now has a working private vulnerability-reporting channel and a complete, current security policy. Fulfills the OSTIF-audit T-21/G-016 deploy step (the src-control repo carries the matching template at docs/security/security.txt). Deploy with website/deploy-git-agentic.command (rsync to the server).
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a standards-compliant, machine-readable security contact entrypoint for the git-agentic.com website and surfaces it (and related security docs) in the site UI, so vulnerability reporters can reliably find the right channels and policy.
Changes:
- Added an RFC 9116
security.txtat/.well-known/security.txt(served fromwebsite/public/). - Added a global footer link to the
security.txtendpoint. - Added
Threat modelandSecuritydocumentation links on thesrc-controllanding page.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| website/src/pages/src-control.astro | Adds direct links to src-control’s threat model and security policy docs. |
| website/src/components/Footer.astro | Adds a site-wide Security link pointing to /.well-known/security.txt. |
| website/public/.well-known/security.txt | Introduces an RFC 9116 security.txt with contact + policy + canonical metadata. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
outputPathFor assumed every internal link maps to a built HTML page, so the footer link to /.well-known/security.txt was checked as security.txt.html and failed. Accept a path that exists as a file in dist (static assets copied from public/) before falling back to the .html / index.html mapping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deploys the machine-readable security contact for git-agentic.com (OSTIF audit T-21/G-016 for src-control; also covers git.agentic and Sentinel).
website/public/.well-known/security.txt— org-wide RFC 9116 file (Astro servespublic/verbatim →https://git-agentic.com/.well-known/security.txt). Contact: email + src-control GitHub advisories; Policy → src-control SECURITY.md (the fullest, shared terms); Expires 2027-07-18.Securitylink to the security.txt on every page.Threat model+Securitydoc links, reflecting that src-control now has a working private vulnerability-reporting channel and a complete, current security policy.Verified:
npm run buildplaces the file atdist/.well-known/security.txtand both links render. Deploy withwebsite/deploy-git-agentic.command(rsync to the server — needs your SSH/sudo).