Security-wg: security.txt file on nodejs.org

[MarcinHoppe]

security.txt files (https://securitytxt.org/) are getting popular these days and I think they are fairly useful in reducing friction in reporting security problems.

I think putting such a file on nodejs.org Web site would not hurt. What do you think about generating and uploading such a file on the Web site?

[ChALkeR]

Yes, this needs to be done imo.
/cc @nodejs/website @nodejs/security.

[lirantal]

That's a great idea.

[bnb]

I love it. Curious how widely used security.txt is in production?

[ChALkeR]

@bnb That's relatively new, but it's emerging pretty fast. Also:

• https://www.google.com/.well-known/security.txt
• https://www.facebook.com/.well-known/security.txt

[djadmin]

+1 for security.txt. I think it could look like this -

Contact: [email protected]
Policy: https://nodejs.org/en/security/
Contribute: https://github.com/nodejs/security-wg :)

Although it is supposed to be in the /.well-known path, it would be great to create an alias to put it in the root as well (just like robots.txt). Facebook has done it too (https://www.facebook.com/security.txt).

[MarcinHoppe]

The spec actually recommends the redirect from the root to /.well-known:

https://tools.ietf.org/html/draft-foudil-securitytxt-03#section-4.1

[MarcinHoppe]

PR nodejs/nodejs.org#1589 submitted against the Node.js Web site repo.

[MarcinHoppe]

The PR ☝️has been merged. We now need the PR to update NGINX configuration to be merged: nodejs/build#1181.

[MarcinHoppe]

Both PRs have been merged, the file has been up on the site for some time now and all seems to be working fine. Closing.