security.txt published

What this means

Passing means https://YOUR_DOMAIN/.well-known/security.txt exists and names a way to contact you. Failing means there is no file, or a file with no contact line. It is a small plain-text file, but it is the standard place a security researcher looks when they find a hole in your app and want to tell you before anyone else finds it.

How we test it

We fetch /.well-known/security.txt on your domain, once, with no credential. Pass is a 200 with a Contact: line. Warn is a 200 whose body has no contact line. Fail is a 404 or any other status.

Why it matters

Researchers who find a hole need somewhere to send it. In the Fix Kit's own audit, the open reporting endpoints were found by a client, who told the owner; a stranger with no obvious address writes a public post instead, or says nothing and the hole stays open. Publishing a contact costs a few minutes and turns the next finding into an email rather than a headline.

The fix

Publish a plain-text file at /.well-known/security.txt on your production domain with a Contact: line pointing at a mailbox you read, served from your static public directory, and add the path to Module 3's templates/public-allowlist.txt so the audit script knows it is public on purpose. Keep it a static file with nothing else in it: no names, no internal hostnames, no hint about what runs where. The full runbook is in the Fix Kit, Module 03.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Run once: curl -s -o /dev/null -w "%{http_code}\n" https://YOUR_DOMAIN/.well-known/security.txt and show me the status.
If it is 200, run curl -s https://YOUR_DOMAIN/.well-known/security.txt and tell me whether a Contact: line is present.
Tell me where static files under /.well-known/ would live in this repo (the public directory for this framework) and whether any routing rule or ignore file would block that path.
Tell me which mailbox the project already uses for support or abuse, by reading the site's footer and contact page, so I can choose the address.
Do not create or change any file; list what it would take to publish the file and stop.
Run the first curl once more and show me the output; expected for a passing project: 200 and a body containing a Contact: line.