Security.txt in APP Konfigurator

[savity]

Hi Everyone,

since security.txt is a https://www.rfc-editor.org/rfc/rfc9116 is there a way to get this done for my APPs?
We are able to modify robots.txt but it would be awesome to do this for security.txt
BR Savity

[nebulon]

Not sure I fully understand the RFC there, but this sounds more like the app itself should ship such a file so researchers discovering a security issue can contact the app authors to let them know?

[savity]

The goal is to provide a way for individuals and teams to report any vulnerabilities found on the website or in the application. For example, this can be set up similarly to the following pages:

https://www.brz.gv.at/security.txt
https://www.bsi.bund.de/security.txt

This approach allows for flexibility in addressing vulnerabilities; they do not always need to be limited to the application side alone.

[nebulon]

I guess we can add this in the app configure section if there is some interest.
Some more context is at https://securitytxt.org/

[johannesjom]

That would be a very cool feature!

[msbt]

@nebulon was that ever implemented or considered? In case of a LAMP app, would it be wise to just create the directory on the server and put the file there like it was suggested here

[nebulon]

no work was done here, it is still not clear to me if really the platform should provide this, as any security report would mostly be towards the app developers, not the one running the app I would assume.

For a lamp app instance or also a surfer website, one can just put a file called security.txt there or am I missing something?

[girish]

I added this a while ago for cloudron.io itself since we get almost one issue everyday from bounty hackers...

https://www.cloudron.io/security.html and https://www.cloudron.io/.well-known/security.txt . The security.txt is not top level but in well-known afaik. Let me know if this is wrong!

.well-known is not overwritten by the platform so you can just add it to the app itself (and thus part of your version control).

[msbt]

@girish thanks, yeah that's what I've done, I was just not sure if you would consider that best practice of if it gets overridden at some point by some other setting in the platform-code