security: add RFC 9116 security.txt + surface security policy links

website/public/.well-known/security.txt

@@ -0,0 +1,11 @@
+# Security contact for git-agentic.com and all git.agentic open-source
+# projects (git.agentic, src-control, Sentinel). RFC 9116.
+# Per-project policies live in each repo's SECURITY.md; the src-control
+# policy below is the fullest (scope, safe harbor, bounty status,
+# coordinated-disclosure terms) and the terms are shared across projects.
+Contact: mailto:toni@git-agentic.com
+Contact: https://github.com/git-agentic/src-control/security/advisories/new
+Expires: 2027-07-18T00:00:00.000Z
+Policy: https://github.com/git-agentic/src-control/blob/main/SECURITY.md
+Preferred-Languages: en, fi
+Canonical: https://git-agentic.com/.well-known/security.txt

website/scripts/check-seo.mjs

@@ -24,6 +24,9 @@ function outputPathFor(url) {
   const path = new URL(url, site).pathname;
   if (path === '/') return join(dist, 'index.html');
   const withoutLeadingSlash = path.slice(1);
+  // Static assets from public/ (e.g. /.well-known/security.txt) exist verbatim in dist.
+  const verbatim = join(dist, withoutLeadingSlash);
+  if (!path.endsWith('/') && existsSync(verbatim) && statSync(verbatim).isFile()) return verbatim;
   return join(dist, path.endsWith('/')
     ? `${withoutLeadingSlash}index.html`
     : `${withoutLeadingSlash}.html`);

website/src/components/Footer.astro

@@ -9,6 +9,7 @@ const gh = 'https://github.com/git-agentic';
     <a href={`${gh}/src-control`}>src-control</a> ·
     <a href={`${gh}/pkg-registry`}>Sentinel</a> ·
     <a href="/learn">Learn</a> ·
+    <a href="/.well-known/security.txt">Security</a> ·
     <a href="mailto:toni@git-agentic.com">toni@git-agentic.com</a>
   </span>
 </footer>

website/src/pages/src-control.astro

@@ -214,6 +214,8 @@ $ npm ci &amp;&amp; npm run tauri dev</code></pre>
   <p class="mute">
     Docs: <a href={`${repo}#readme`}>README</a> ·
     <a href={`${repo}/blob/main/ARCHITECTURE.md`}>Architecture</a> ·
+    <a href={`${repo}/blob/main/docs/THREAT-MODEL.md`}>Threat model</a> ·
+    <a href={`${repo}/blob/main/SECURITY.md`}>Security</a> ·
     <a href={desktop}>Desktop app</a> ·
     <a href={`${repo}/tree/main/docs/adr`}>ADRs</a>
   </p>