From 099dcb964cd8f52b49735ab82829e2340876f0d6 Mon Sep 17 00:00:00 2001 From: Marcin Rataj Date: Thu, 6 Aug 2026 19:55:46 +0200 Subject: [PATCH 1/2] chore: add security.txt to v2 site Publishes an RFC 9116 security contact at https://ipfs.tech/.well-known/security.txt, so scanners and researchers looking for a reporting route find security@ipfs.io without digging through repos. The Expires field is set to 2027-08-01 and has to be moved forward before then, or the file is treated as stale. --- v2/public/.well-known/security.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 v2/public/.well-known/security.txt diff --git a/v2/public/.well-known/security.txt b/v2/public/.well-known/security.txt new file mode 100644 index 0000000..b2944f6 --- /dev/null +++ b/v2/public/.well-known/security.txt @@ -0,0 +1,12 @@ +# Security contact for ipfs.tech, in the format defined by RFC 9116. +# https://www.rfc-editor.org/rfc/rfc9116 + +Contact: mailto:security@ipfs.io +Expires: 2027-08-01T00:00:00Z +Policy: https://github.com/ipfs/community/blob/master/SECURITY.md +Canonical: https://ipfs.tech/.well-known/security.txt +Preferred-Languages: en + +# Content reachable through a public IPFS gateway is not a vulnerability in +# IPFS software. Report gateway abuse to whoever runs that gateway: +# https://docs.ipfs.tech/concepts/public-utilities/#abuse-policy From 0674cc2e6b027ad00bf009cd78d345aba6bd5124 Mon Sep 17 00:00:00 2001 From: Marcin Rataj Date: Thu, 6 Aug 2026 20:13:22 +0200 Subject: [PATCH 2/2] chore: generate security.txt at build time Replaces the static file with an Astro endpoint so the RFC 9116 Expires field moves forward on its own instead of going stale a year from now. The value is the first of the build month, twelve months out, so repeat builds within the same month stay byte-identical and the deployed CID does not churn. --- v2/public/.well-known/security.txt | 12 ----------- v2/src/pages/.well-known/security.txt.ts | 27 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 12 deletions(-) delete mode 100644 v2/public/.well-known/security.txt create mode 100644 v2/src/pages/.well-known/security.txt.ts diff --git a/v2/public/.well-known/security.txt b/v2/public/.well-known/security.txt deleted file mode 100644 index b2944f6..0000000 --- a/v2/public/.well-known/security.txt +++ /dev/null @@ -1,12 +0,0 @@ -# Security contact for ipfs.tech, in the format defined by RFC 9116. -# https://www.rfc-editor.org/rfc/rfc9116 - -Contact: mailto:security@ipfs.io -Expires: 2027-08-01T00:00:00Z -Policy: https://github.com/ipfs/community/blob/master/SECURITY.md -Canonical: https://ipfs.tech/.well-known/security.txt -Preferred-Languages: en - -# Content reachable through a public IPFS gateway is not a vulnerability in -# IPFS software. Report gateway abuse to whoever runs that gateway: -# https://docs.ipfs.tech/concepts/public-utilities/#abuse-policy diff --git a/v2/src/pages/.well-known/security.txt.ts b/v2/src/pages/.well-known/security.txt.ts new file mode 100644 index 0000000..69aa52b --- /dev/null +++ b/v2/src/pages/.well-known/security.txt.ts @@ -0,0 +1,27 @@ +import type { APIRoute } from 'astro' + +// RFC 9116 requires an Expires field and recommends keeping it under a year +// out, so it is derived from the build rather than hardcoded and left to rot. +// Rounding to the first of the month keeps repeat builds within a month +// byte-identical, which matters because the deployed CID covers this output. +const now = new Date() +const expires = new Date(Date.UTC(now.getUTCFullYear() + 1, now.getUTCMonth(), 1)) + +const body = `# Security contact for ipfs.tech, in the format defined by RFC 9116. +# https://www.rfc-editor.org/rfc/rfc9116 + +Contact: mailto:security@ipfs.io +Expires: ${expires.toISOString().replace('.000Z', 'Z')} +Policy: https://github.com/ipfs/community/blob/master/SECURITY.md +Canonical: https://ipfs.tech/.well-known/security.txt +Preferred-Languages: en + +# Content reachable through a public IPFS gateway is not a vulnerability in +# IPFS software. Report gateway abuse to whoever runs that gateway: +# https://docs.ipfs.tech/concepts/public-utilities/#abuse-policy +` + +export const GET: APIRoute = () => + new Response(body, { + headers: { 'Content-Type': 'text/plain; charset=utf-8' }, + })