What is happening
https://go.dev/.well-known/security.txt returns HTTP 404, and so does https://golang.org/.well-known/security.txt.
Meanwhile Go advertises a formal security/vulnerability reporting process — https://go.dev/security/policy returns HTTP 200 and describes how to report — so there is a policy, just no machine-discoverable security.txt pointing to it.
Why it matters
RFC 9116 defines /.well-known/security.txt as the standard, machine-readable place a researcher (or automated tooling) looks first to find where and how to report a security issue. Serving one that points at the existing policy makes Go's already-published process discoverable by the convention researchers actually check.
Suggested fix
Serve a small security.txt at go.dev/.well-known/security.txt (via the x/website site) with at least the RFC-mandatory fields, e.g.:
Contact: https://go.dev/security/policy
Expires: <a future date, per RFC 9116 §2.5.5>
Policy: https://go.dev/security/policy
I'm happy to send the change through Gerrit if this seems worthwhile.
Reproduction
curl -sSL -o /dev/null -w '%{http_code}\n' https://go.dev/.well-known/security.txt # => 404
curl -sSL -o /dev/null -w '%{http_code}\n' https://go.dev/security/policy # => 200
I used AI assistance to help investigate and draft this; I reproduced the facts above myself and take responsibility for the report.
What is happening
https://go.dev/.well-known/security.txtreturns HTTP 404, and so doeshttps://golang.org/.well-known/security.txt.Meanwhile Go advertises a formal security/vulnerability reporting process —
https://go.dev/security/policyreturns HTTP 200 and describes how to report — so there is a policy, just no machine-discoverablesecurity.txtpointing to it.Why it matters
RFC 9116 defines
/.well-known/security.txtas the standard, machine-readable place a researcher (or automated tooling) looks first to find where and how to report a security issue. Serving one that points at the existing policy makes Go's already-published process discoverable by the convention researchers actually check.Suggested fix
Serve a small
security.txtatgo.dev/.well-known/security.txt(via thex/websitesite) with at least the RFC-mandatory fields, e.g.:I'm happy to send the change through Gerrit if this seems worthwhile.
Reproduction
I used AI assistance to help investigate and draft this; I reproduced the facts above myself and take responsibility for the report.