From 530429a20fe350046061ebf64be632b887200225 Mon Sep 17 00:00:00 2001
From: adamXbot <111877622+adamXbot@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:54:38 +1100
Subject: [PATCH] Add RFC 9116 security.txt for
 docs.privacycommand.privacykey.org

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .well-known/security.txt | 32 ++++++++++++++++++++++++++++++++
 _headers                 |  4 ++++
 package.json             |  2 +-
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 .well-known/security.txt
 create mode 100644 _headers

diff --git a/.well-known/security.txt b/.well-known/security.txt
new file mode 100644
index 0000000..53ecbdf
--- /dev/null
+++ b/.well-known/security.txt
@@ -0,0 +1,32 @@
+# privacycommand documentation — Security disclosure policy
+# RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116
+# Last updated: 2026-10-09
+
+# Preferred channel: GitHub Private Vulnerability Reporting on the product repo
+Contact: https://github.com/privacykey/privacycommand/security/advisories/new
+
+# Encrypted email fallback. Plaintext security reports are NOT accepted —
+# the OpenPGP key is published via the Encryption field below.
+Contact: mailto:security@privacykey.org
+
+# OpenPGP key for encrypted reports: the armored key, and its fingerprint.
+Encryption: https://github.com/AdamXweb.gpg
+Encryption: openpgp4fpr:54BFCE808324E569FB1919B304AAA3CBD117D9B2
+
+# Full disclosure policy, scope, safe-harbor terms, and what to include
+# in a report — please read this before submitting.
+Policy: https://github.com/privacykey/privacycommand/blob/main/.github/SECURITY.md
+
+# Researchers who reported confirmed issues are credited in the
+# "Hall of fame" section of the policy and on the GitHub advisory.
+Acknowledgments: https://github.com/privacykey/privacycommand/blob/main/.github/SECURITY.md#hall-of-fame
+
+# Canonical location for this file
+Canonical: https://docs.privacycommand.privacykey.org/.well-known/security.txt
+
+# Languages we can respond in
+Preferred-Languages: en
+
+# Refresh before this date. RFC 9116 requires Expires; clients (and
+# bug-bounty platforms) reject expired files.
+Expires: 2027-10-01T00:00:00Z
diff --git a/_headers b/_headers
new file mode 100644
index 0000000..daca6ea
--- /dev/null
+++ b/_headers
@@ -0,0 +1,4 @@
+# Workers static assets header rules (not served itself). Copied into dist/ by `npm run build`.
+# RFC 9116 §3 requires security.txt to be served as text/plain with charset utf-8.
+/.well-known/security.txt
+  Content-Type: text/plain; charset=utf-8
diff --git a/package.json b/package.json
index ed6e98e..5f34ce3 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,7 @@
   "repository": "https://github.com/privacykey/docs-privacycommand",
   "scripts": {
     "dev": "npx --yes mint dev",
-    "build": "rm -rf dist export.zip && npx --yes mint@latest export && mkdir -p dist && (unzip -q -o export.zip -d dist || python3 -m zipfile -e export.zip dist) && cp .assetsignore dist/.assetsignore && node scripts/build-llms.mjs --dist dist",
+    "build": "rm -rf dist export.zip && npx --yes mint@latest export && mkdir -p dist && (unzip -q -o export.zip -d dist || python3 -m zipfile -e export.zip dist) && cp .assetsignore dist/.assetsignore && cp _headers dist/_headers && mkdir -p dist/.well-known && cp -R .well-known/. dist/.well-known/ && node scripts/build-llms.mjs --dist dist",
     "check": "node scripts/check-docs.mjs && node scripts/build-llms.mjs --check",
     "llms": "node scripts/build-llms.mjs",
     "linkcheck": "lychee --no-progress --accept-timeouts --accept '100..=103,200..=299,429' --root-dir \"$PWD\" --scheme https --scheme http --exclude-loopback --exclude 'localhost' --exclude 'dash\\.cloudflare\\.com' --exclude 'docs\\.([a-z0-9-]+\\.)?privacykey\\.org' --exclude-path images --exclude-path .github './**/*.mdx' './**/*.md'"