Add RFC 9116 security.txt for docs.privacycommand.privacykey.org

.well-known/security.txt

@@ -0,0 +1,32 @@
+# privacycommand documentation — Security disclosure policy
+# RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116
+# Last updated: 2026-10-09
+
+# Preferred channel: GitHub Private Vulnerability Reporting on the product repo
+Contact: https://github.com/privacykey/privacycommand/security/advisories/new
+
+# Encrypted email fallback. Plaintext security reports are NOT accepted —
+# the OpenPGP key is published via the Encryption field below.
+Contact: mailto:security@privacykey.org
+
+# OpenPGP key for encrypted reports: the armored key, and its fingerprint.
+Encryption: https://github.com/AdamXweb.gpg
+Encryption: openpgp4fpr:54BFCE808324E569FB1919B304AAA3CBD117D9B2
+
+# Full disclosure policy, scope, safe-harbor terms, and what to include
+# in a report — please read this before submitting.
+Policy: https://github.com/privacykey/privacycommand/blob/main/.github/SECURITY.md
+
+# Researchers who reported confirmed issues are credited in the
+# "Hall of fame" section of the policy and on the GitHub advisory.
+Acknowledgments: https://github.com/privacykey/privacycommand/blob/main/.github/SECURITY.md#hall-of-fame
+
+# Canonical location for this file
+Canonical: https://docs.privacycommand.privacykey.org/.well-known/security.txt
+
+# Languages we can respond in
+Preferred-Languages: en
+
+# Refresh before this date. RFC 9116 requires Expires; clients (and
+# bug-bounty platforms) reject expired files.
+Expires: 2027-10-01T00:00:00Z

_headers

@@ -0,0 +1,4 @@
+# Workers static assets header rules (not served itself). Copied into dist/ by `npm run build`.
+# RFC 9116 §3 requires security.txt to be served as text/plain with charset utf-8.
+/.well-known/security.txt
+  Content-Type: text/plain; charset=utf-8

package.json

@@ -7,7 +7,7 @@
   "repository": "https://github.com/privacykey/docs-privacycommand",
   "scripts": {
     "dev": "npx --yes mint dev",
-    "build": "rm -rf dist export.zip && npx --yes mint@latest export && mkdir -p dist && (unzip -q -o export.zip -d dist || python3 -m zipfile -e export.zip dist) && cp .assetsignore dist/.assetsignore && node scripts/build-llms.mjs --dist dist",
+    "build": "rm -rf dist export.zip && npx --yes mint@latest export && mkdir -p dist && (unzip -q -o export.zip -d dist || python3 -m zipfile -e export.zip dist) && cp .assetsignore dist/.assetsignore && cp _headers dist/_headers && mkdir -p dist/.well-known && cp -R .well-known/. dist/.well-known/ && node scripts/build-llms.mjs --dist dist",
     "check": "node scripts/check-docs.mjs && node scripts/build-llms.mjs --check",
     "llms": "node scripts/build-llms.mjs",
     "linkcheck": "lychee --no-progress --accept-timeouts --accept '100..=103,200..=299,429' --root-dir \"$PWD\" --scheme https --scheme http --exclude-loopback --exclude 'localhost' --exclude 'dash\\.cloudflare\\.com' --exclude 'docs\\.([a-z0-9-]+\\.)?privacykey\\.org' --exclude-path images --exclude-path .github './**/*.mdx' './**/*.md'"