key-store/key.store
15
0
Fork 0
Code Pull requests 18 Releases 180 Activity Actions 5

security: publish RFC 9116 reporting metadata #234

Open
security-agent wants to merge 1 commit from security/security-txt-rfc9116 into main
pull from: security/security-txt-rfc9116
merge into: key-store:main
Conversation 3 Commits 1 Files changed 5 +234
security-agent commented 2026-09-06 21:01:17 +00:00
Member
Copy link

Summary

  • publish one RFC 9116 security.txt file for key.store and lately.org, expiring 2027-02-28T00:00:00Z
  • add the root vulnerability-reporting policy and propose acknowledgement/scope wording for founder review
  • stop unknown /.well-known/* paths from falling into either SPA while preserving exact routes and the WKD tree
  • validate RFC 3339 structure deterministically in the Nix build and enforce freshness in the Bazel lint lane
  • include the missing LatelySecretStore source in the filtered wasm input; without this existing omission, nix build .#web-container failed before reaching the web derivation

Redmine: https://todo.key.store/issues/7
First-work child: https://todo.key.store/issues/22
Renewal reminder (due 2027-01-29): https://todo.key.store/issues/8

Proposed policy wording for review

  • Acknowledgement target: three business days, explicitly described as a target rather than a guaranteed resolution SLA.
  • Scope: production services on key.store and its subdomains; lately.org; and official key.store/Lately web, Apple-platform, Android, Linux, Windows, KaiOS, and browser-extension surfaces built and distributed from this repository.
  • Out of scope: third-party systems, disruptive availability testing, social engineering, spam, and physical attacks.
  • No paid bounty is promised; key.store remains free.

The requested main-branch policy URL, https://git.key.store/key-store/key.store/src/branch/main/SECURITY.md, returned anonymous HTTP 404 before this PR. The branch version loads anonymously, but I did not add a Policy: field because the exact main URL cannot be relied on until merge.

Validation

  • bash bazel/web/runner.sh lint-build — passed after rebasing onto current main
  • nix build --accept-flake-config .#web-container — passed after rebasing onto current main
  • stale full validation — failed as required:
[security-txt-check] Expires is stale: 2026-09-05T00:00:00Z
  • the same stale file with --format-only — passed, proving the Nix-mode check has no clock dependency
  • under-30-day input — passed with a warning
  • over-one-year input — failed

Local nginx curl matrix

Generated from the built container's nginx.conf and built site with Host headers:

host	path	status	type	redirect
key.store	/.well-known/security.txt	200	text/plain	
key.store	/security.txt	308	text/html	https://key.store/.well-known/security.txt
key.store	/.well-known/does-not-exist	404	text/html	
key.store	/.well-known/apple-app-site-association	200	application/json	
key.store	/.well-known/jmap	200	application/json	
key.store	/.well-known/webfinger?resource=acct:test@key.store	200	application/jrd+json	
key.store	/.well-known/lately/web-application	200	application/json	
key.store	/.well-known/lately/native-application	200	application/json	
key.store	/.well-known/caldav	308	text/html	https://mail.key.store/.well-known/caldav
key.store	/.well-known/carddav	308	text/html	https://mail.key.store/.well-known/carddav
key.store	/.well-known/openpgpkey/key.store/policy	200	application/octet-stream	
lately.org	/.well-known/security.txt	200	text/plain	
lately.org	/security.txt	308	text/html	https://lately.org/.well-known/security.txt
lately.org	/.well-known/does-not-exist	404	text/html	
lately.org	/.well-known/apple-app-site-association	200	application/json	
lately.org	/.well-known/jmap	200	application/json	
lately.org	/.well-known/webfinger?resource=acct:test@key.store	200	application/jrd+json	
lately.org	/.well-known/lately/web-application	200	application/json	
lately.org	/.well-known/lately/native-application	200	application/json	
lately.org	/.well-known/caldav	404	text/html	
lately.org	/.well-known/carddav	404	text/html	
lately.org	/.well-known/openpgpkey/key.store/policy	200	application/octet-stream
## Summary - publish one RFC 9116 `security.txt` file for `key.store` and `lately.org`, expiring `2027-02-28T00:00:00Z` - add the root vulnerability-reporting policy and propose acknowledgement/scope wording for founder review - stop unknown `/.well-known/*` paths from falling into either SPA while preserving exact routes and the WKD tree - validate RFC 3339 structure deterministically in the Nix build and enforce freshness in the Bazel lint lane - include the missing `LatelySecretStore` source in the filtered wasm input; without this existing omission, `nix build .#web-container` failed before reaching the web derivation Redmine: https://todo.key.store/issues/7 First-work child: https://todo.key.store/issues/22 Renewal reminder (due 2027-01-29): https://todo.key.store/issues/8 ## Proposed policy wording for review - **Acknowledgement target:** three business days, explicitly described as a target rather than a guaranteed resolution SLA. - **Scope:** production services on `key.store` and its subdomains; `lately.org`; and official key.store/Lately web, Apple-platform, Android, Linux, Windows, KaiOS, and browser-extension surfaces built and distributed from this repository. - **Out of scope:** third-party systems, disruptive availability testing, social engineering, spam, and physical attacks. - No paid bounty is promised; key.store remains free. The requested main-branch policy URL, `https://git.key.store/key-store/key.store/src/branch/main/SECURITY.md`, returned anonymous HTTP 404 before this PR. The branch version loads anonymously, but I did **not** add a `Policy:` field because the exact main URL cannot be relied on until merge. ## Validation - `bash bazel/web/runner.sh lint-build` — passed after rebasing onto current main - `nix build --accept-flake-config .#web-container` — passed after rebasing onto current main - stale full validation — failed as required: ```text [security-txt-check] Expires is stale: 2026-09-05T00:00:00Z ``` - the same stale file with `--format-only` — passed, proving the Nix-mode check has no clock dependency - under-30-day input — passed with a warning - over-one-year input — failed ### Local nginx curl matrix Generated from the built container's `nginx.conf` and built site with `Host` headers: ```text host path status type redirect key.store /.well-known/security.txt 200 text/plain key.store /security.txt 308 text/html https://key.store/.well-known/security.txt key.store /.well-known/does-not-exist 404 text/html key.store /.well-known/apple-app-site-association 200 application/json key.store /.well-known/jmap 200 application/json key.store /.well-known/webfinger?resource=acct:test@key.store 200 application/jrd+json key.store /.well-known/lately/web-application 200 application/json key.store /.well-known/lately/native-application 200 application/json key.store /.well-known/caldav 308 text/html https://mail.key.store/.well-known/caldav key.store /.well-known/carddav 308 text/html https://mail.key.store/.well-known/carddav key.store /.well-known/openpgpkey/key.store/policy 200 application/octet-stream lately.org /.well-known/security.txt 200 text/plain lately.org /security.txt 308 text/html https://lately.org/.well-known/security.txt lately.org /.well-known/does-not-exist 404 text/html lately.org /.well-known/apple-app-site-association 200 application/json lately.org /.well-known/jmap 200 application/json lately.org /.well-known/webfinger?resource=acct:test@key.store 200 application/jrd+json lately.org /.well-known/lately/web-application 200 application/json lately.org /.well-known/lately/native-application 200 application/json lately.org /.well-known/caldav 404 text/html lately.org /.well-known/carddav 404 text/html lately.org /.well-known/openpgpkey/key.store/policy 200 application/octet-stream ```
security: publish RFC 9116 reporting metadata
Some checks failed
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 29s
Details
Build: Web / Build (Web) (pull_request) Successful in 40s
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 3m58s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 2m22s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
56f418515a
founder approved these changes 2026-09-13 12:10:41 +00:00
founder left a comment
Copy link

Founder sign-off, recorded by Codex at Conrad’s explicit request on 2026-09-13: this first-work-wave change is approved. Resolve any conflicts and satisfy the required checks before merging. This records the founder’s approval; it does not assert that failing checks have passed.

Founder sign-off, recorded by Codex at Conrad’s explicit request on 2026-09-13: this first-work-wave change is approved. Resolve any conflicts and satisfy the required checks before merging. This records the founder’s approval; it does not assert that failing checks have passed.
security-agent force-pushed security/security-txt-rfc9116 from 56f418515a
Some checks failed
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 29s
Details
Build: Web / Build (Web) (pull_request) Successful in 40s
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 3m58s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 2m22s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
to bee03cee1b
Some checks failed
Build: Web / Build (Web) (pull_request) Successful in 46s
Details
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 2m52s
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 4m39s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 14m29s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
2026-09-13 23:33:42 +00:00 Compare
security-agent commented 2026-09-13 23:33:50 +00:00
Author
Member
Copy link

Rebased onto current main (6bee2614). One conflict in flake.nix resolved: kept the KSE-0195 E1 comment; dropped my one-line LatelySecretStore addition as already present upstream. Patch vs new base is the same 5 files. Verified locally: node Web/scripts/check-security-txt.mjs --format-only passes. Ready for independent review; I cannot approve my own change.

Rebased onto current main (6bee2614). One conflict in flake.nix resolved: kept the KSE-0195 E1 comment; dropped my one-line LatelySecretStore addition as already present upstream. Patch vs new base is the same 5 files. Verified locally: node Web/scripts/check-security-txt.mjs --format-only passes. Ready for independent review; I cannot approve my own change.
security-agent force-pushed security/security-txt-rfc9116 from bee03cee1b
Some checks failed
Build: Web / Build (Web) (pull_request) Successful in 46s
Details
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 2m52s
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 4m39s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 14m29s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
to 0aee8c5ffd
Some checks failed
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 2m26s
Details
Build: Web / Build (Web) (pull_request) Successful in 3m58s
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 4m7s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 5m14s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
2026-09-14 00:22:28 +00:00 Compare
security-agent commented 2026-09-14 00:22:41 +00:00
Author
Member
Copy link

Rebased onto current main (a8d14c50): single commit 0aee8c5f, signed, no conflicts. Validation: node Web/scripts/check-security-txt.mjs Web/public/.well-known/security.txt -> ok (full mode, Expires 2027-02-28); diff secret-scan clean (only policy prose mentions). Ready for independent review — I will not approve my own PR.

Rebased onto current main (`a8d14c50`): single commit `0aee8c5f`, signed, no conflicts. Validation: `node Web/scripts/check-security-txt.mjs Web/public/.well-known/security.txt` -> ok (full mode, Expires 2027-02-28); diff secret-scan clean (only policy prose mentions). Ready for independent review — I will not approve my own PR.
Some checks failed
Build: KaiOS / Build (KaiOS) (pull_request) Successful in 2m26s
Details
Build: Web / Build (Web) (pull_request) Successful in 3m58s
Details
Build: Linux / Build (Linux x86_64) (pull_request) Successful in 4m7s
Details
Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped
Details
Build: Apple / Check (SwiftLint) (pull_request) Failing after 5m14s
Details
Build: Apple / Build (macOS) (pull_request) Has been skipped
Details
Build: Apple / Build (iOS) (pull_request) Has been skipped
Details
Build: Apple / Build (visionOS) (pull_request) Has been skipped
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin security/security-txt-rfc9116:security/security-txt-rfc9116
git switch security/security-txt-rfc9116
Sign in to join this conversation.
Reviewers
No reviewers
billing
manager
agent
cdo
forge
windows
web
release-runner
infra
cmo
assistant
runner
android
linux
ios
devex
founder
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
key-store/key.store!234
No description provided.