From 8442f45c99b648183fff2ffaca35dc9d807c1bf4 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Tue, 14 Jul 2026 14:27:37 +0300 Subject: [PATCH] Add /.well-known/security.txt (RFC 9116) helm.sh serves no security.txt at the well-known location, so a researcher following RFC 9116 has no machine-discoverable pointer to Helm's security reporting channel (the CNCF Helm security list). Added under static/, pointing Contact at that list and Policy at the community SECURITY.md. Signed-off-by: Kobi Hikri --- static/.well-known/security.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 static/.well-known/security.txt diff --git a/static/.well-known/security.txt b/static/.well-known/security.txt new file mode 100644 index 0000000000..ec2b8fa3ce --- /dev/null +++ b/static/.well-known/security.txt @@ -0,0 +1,5 @@ +Contact: mailto:cncf-helm-security@lists.cncf.io +Expires: 2027-07-14T00:00:00.000Z +Preferred-Languages: en +Canonical: https://helm.sh/.well-known/security.txt +Policy: https://github.com/helm/community/blob/main/SECURITY.md