Repository navigation
feat: publish security.txt (RFC 9116) at /.well-known/security.txt - #40
Merged
Merged
Conversation
Adds a machine-readable security contact for edulab.appalachiancloud.co. Before this, GET /.well-known/security.txt returned HTTP 200 with index.html (CloudFront's SPA error mapping), so a scanner saw a "success" that was actually HTML. Publishing a real object fixes that. The file is excluded from the immutable `aws s3 sync` and uploaded by its own `aws s3 cp` with `text/plain; charset=utf-8` and `max-age=3600`: it carries an RFC 9116 `Expires` date (2027-08-31) that must be refreshed before it lapses, and a one-year immutable cache would outlive the fix. Being excluded also keeps it safe from the sync's `--delete`, the same way index.html/contact.html already are. Part of an estate-wide rollout; the domain matrix and shared renewal date live in mountain-infra/AGENTS.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Y7PCTaciw6HtEC1eLL185
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes a machine-readable security contact for
edulab.appalachiancloud.co. One of three PRs in an estate-wide rollout (the domain matrix lives inmountain-infra/AGENTS.md).Assumption to confirm:
Contact:ismailto:cgallagher@keengeek.com— the address that already receives the estate's security alerts, chosen because it is known to deliver. If you'd rather use asecurity@alias, all three content apexes have Google Workspace MX; swapping it in is a one-line change per copy.Why this isn't just "add a file"
GET /.well-known/security.txtalready returned HTTP 200 on this site before this PR — CloudFront'scustom_error_responsemaps 403/404 to/index.htmlwith status 200, so a scanner hunting for a security contact got a "success" that was really HTML. Verification therefore has to assertcontent-typeand body, not status alone. That trap is now written intoAGENTS.mdandDEPLOY.md.The deploy step needs care
The sync stamps everything
immutable, max-age=31536000.security.txtcarries an RFC 9116Expiresdate that must be refreshed before it lapses (an elapsed file is invalid, not merely stale), so a one-year immutable cache would outlive the fix. It is therefore--excluded from the sync and copied separately withtext/plain; charset=utf-8andmax-age=3600— the same shape as the existingindex.html/contact.htmlspecial-case, which also means the sync's--deleteleaves it alone.Renewal
Expires: 2027-08-31T00:00:00.000Z, duplicated across four copies in three repos. Treat them as one set; matrix and deadline are inmountain-infra/AGENTS.md.Verify after merge
Expect
200,content-type: text/plain; charset=utf-8, and aContact:line.🤖 Generated with Claude Code
https://claude.ai/code/session_012Y7PCTaciw6HtEC1eLL185