From bd3a6af87bfe08904ef3a68ac2fa0385db42fa2e Mon Sep 17 00:00:00 2001 From: Toni Bergholm Date: Sat, 18 Jul 2026 14:00:56 +0300 Subject: [PATCH 1/2] security: add RFC 9116 security.txt + surface security policy links - website/public/.well-known/security.txt: org-wide security contact (email + src-control GitHub advisories), Policy -> src-control SECURITY.md, Expires 2027-07-18, Canonical git-agentic.com. Astro serves public/ verbatim, so it lands at https://git-agentic.com/.well-known/security.txt. - Footer: add a 'Security' link to the security.txt (org-wide, every page). - src-control page Docs line: add Threat model + Security (SECURITY.md) links, reflecting that src-control now has a working private vulnerability-reporting channel and a complete, current security policy. Fulfills the OSTIF-audit T-21/G-016 deploy step (the src-control repo carries the matching template at docs/security/security.txt). Deploy with website/deploy-git-agentic.command (rsync to the server). --- website/public/.well-known/security.txt | 11 +++++++++++ website/src/components/Footer.astro | 1 + website/src/pages/src-control.astro | 2 ++ 3 files changed, 14 insertions(+) create mode 100644 website/public/.well-known/security.txt diff --git a/website/public/.well-known/security.txt b/website/public/.well-known/security.txt new file mode 100644 index 0000000..6828adb --- /dev/null +++ b/website/public/.well-known/security.txt @@ -0,0 +1,11 @@ +# Security contact for git-agentic.com and all git.agentic open-source +# projects (git.agentic, src-control, Sentinel). RFC 9116. +# Per-project policies live in each repo's SECURITY.md; the src-control +# policy below is the fullest (scope, safe harbor, bounty status, +# coordinated-disclosure terms) and the terms are shared across projects. +Contact: mailto:toni@git-agentic.com +Contact: https://github.com/git-agentic/src-control/security/advisories/new +Expires: 2027-07-18T00:00:00.000Z +Policy: https://github.com/git-agentic/src-control/blob/main/SECURITY.md +Preferred-Languages: en, fi +Canonical: https://git-agentic.com/.well-known/security.txt diff --git a/website/src/components/Footer.astro b/website/src/components/Footer.astro index e45b739..3c65a47 100644 --- a/website/src/components/Footer.astro +++ b/website/src/components/Footer.astro @@ -9,6 +9,7 @@ const gh = 'https://github.com/git-agentic'; src-control · Sentinel · Learn · + Security · toni@git-agentic.com diff --git a/website/src/pages/src-control.astro b/website/src/pages/src-control.astro index d5c87a6..200973a 100644 --- a/website/src/pages/src-control.astro +++ b/website/src/pages/src-control.astro @@ -214,6 +214,8 @@ $ npm ci && npm run tauri dev

Docs: README · Architecture · + Threat model · + Security · Desktop app · ADRs

From be65406c9ed2084391bcc8b50ddbcba530b9bde2 Mon Sep 17 00:00:00 2001 From: Toni Bergholm Date: Sat, 18 Jul 2026 14:06:06 +0300 Subject: [PATCH 2/2] Accept verbatim static assets in the SEO link checker outputPathFor assumed every internal link maps to a built HTML page, so the footer link to /.well-known/security.txt was checked as security.txt.html and failed. Accept a path that exists as a file in dist (static assets copied from public/) before falling back to the .html / index.html mapping. --- website/scripts/check-seo.mjs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/website/scripts/check-seo.mjs b/website/scripts/check-seo.mjs index 5150603..d34c4ed 100644 --- a/website/scripts/check-seo.mjs +++ b/website/scripts/check-seo.mjs @@ -24,6 +24,9 @@ function outputPathFor(url) { const path = new URL(url, site).pathname; if (path === '/') return join(dist, 'index.html'); const withoutLeadingSlash = path.slice(1); + // Static assets from public/ (e.g. /.well-known/security.txt) exist verbatim in dist. + const verbatim = join(dist, withoutLeadingSlash); + if (!path.endsWith('/') && existsSync(verbatim) && statSync(verbatim).isFile()) return verbatim; return join(dist, path.endsWith('/') ? `${withoutLeadingSlash}index.html` : `${withoutLeadingSlash}.html`);