feat(security): serve /.well-known/security.txt (RFC 9116) - #129
Merged
Conversation
Cloudflare's security-insights scan flags nhimbe.com under "Security.txt not configured" — there was no vulnerability-disclosure contact at a machine-discoverable location, so a researcher's only route was guessing an address. Served as a route handler rather than a static file in public/ because RFC 9116 makes Expires mandatory and caps it at a year ahead: a checked-in file becomes non-compliant purely by ageing. Deriving it per request (180 days out) means it cannot expire. Lists both production origins under Canonical, since either host serves this app and a mismatch is grounds for a scanner to distrust the file. Points at the existing SECURITY.md for policy and at security@nyuchi.com, matching what SECURITY.md already tells reporters. Tests assert the required fields, both canonicals, that Expires is in the future and inside the one-year maximum, and that there is exactly one Expires line.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
bryanfawcett
marked this pull request as ready for review
August 12, 2026 06:57
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cloudflare's security-insights scan flags
nhimbe.comunder "Security.txt not configured" — there was no vulnerability-disclosure contact at a machine-discoverable location, so a researcher's only route was guessing an address.Served as a route handler, not a static file in
public/, for a specific reason: RFC 9116 makesExpiresmandatory and caps it at a year out, so a checked-in file becomes non-compliant purely by ageing. Deriving it per request (180 days ahead) means it can't expire.Both production origins are listed under
Canonical, since either host serves this app and RFC 9116 §2.5.5 wants every URI the file is reachable at — a mismatch is grounds for a scanner to distrust it. Contact and Policy match whatSECURITY.mdalready tells reporters.Test plan
npm run test:run— 891 passed (4 new)npm run lint— 0 errors (23 pre-existing warnings, none new)Expiresis in the future and inside the one-year maximum; exactly oneExpireslineContext
Part of working through a Cloudflare Security Insights export (318 active findings). Of the 43
security.txtfindings, three are on domains served by repos I have access to —nhimbe.com(this one),barstool.co.zw(kweli), andmukoko.com(themarketingrepo, which I don't have access to).Worth recording what the same export says about the 8 Critical "Exposed RDP Servers" findings, since that's what prompted this sweep: they name
api.nyuchi.com,auth.nyuchi.com,fundi.nyuchi.comandcouch.mukoko.com, with detection "TCP connections on port 3389 for this host succeed." I could not reproduce that. A raw socket connect to:3389on all four times out, while:443connects instantly through the same code path — and three of the four sit on Fly shared IPv4s, where only 80/443 are routable by construction. The fourth (fundi) has a dedicated IPv4 whose app config defines only 80/443. Three independent lines point to a false positive. The one caveat I can't rule out from this sandbox is filtered outbound 3389 and no IPv6 egress.🤖 Generated with Claude Code
https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
Generated by Claude Code