Skip to content

chore(security.txt): make compliant by adding an Expires field #9005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kobihikri wants to merge 3 commits into
base: main
Choose a base branch
from
+56 −0
Open

chore(security.txt): make compliant by adding an Expires field #9005

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8fe53ce
security.txt: add required Expires field
kobihikri Jul 14, 2026
0679b62
ci: add workflow to auto-refresh security.txt Expires
kobihikri Jul 14, 2026
e2a51ca
ci: make security.txt refresh a yearly, drift-free bump
kobihikri Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/security-txt-expiry.yml
View file
Open in desktop

@avivkeller avivkeller Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's call this bump-security-txt-expiry.yml so it's clear this bumps it

Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# Refreshes apps/site/public/.well-known/security.txt so its RFC 9116 Expires
# field never silently lapses. Runs once a year and opens a PR bumping Expires
# ~13 months out — a human must confirm the contact/policy are still valid
# before merging. The generous window (>1yr) means the file never expires even
# if a run is delayed, and anchoring to the fixed yearly run avoids drift.
Comment on lines +1 to +5

@avivkeller avivkeller Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Refreshes apps/site/public/.well-known/security.txt so its RFC 9116 Expires
# field never silently lapses. Runs once a year and opens a PR bumping Expires
# ~13 months out — a human must confirm the contact/policy are still valid
# before merging. The generous window (>1yr) means the file never expires even
# if a run is delayed, and anchoring to the fixed yearly run avoids drift.
# Security Notes
# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions)
# for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions.
# REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!!
# AUTHORS, please only use actions with explicit SHA references, and avoid using `@master` or `@main` references or `@version` tags.

name: Refresh security.txt Expires

on:
workflow_dispatch:
schedule:
- cron: '0 8 1 1 *' # once a year, Jan 1 at 08:00 UTC

permissions: {}

jobs:
refresh-expires:
runs-on: ubuntu-latest
if: github.repository_owner == 'nodejs'
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

@avivkeller avivkeller Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Run pinact -u on this file, please

with:
persist-credentials: false

- name: Bump Expires (~13 months out)
env:
SECURITY_TXT: apps/site/public/.well-known/security.txt
run: |
set -euo pipefail
new=$(date -u -d '+400 days' +%Y-%m-%dT23:59:59.000Z)

@cursor cursor Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yearly refresh leaves thin expiry buffer

Medium Severity

The yearly cron plus a human-merge PR only leaves about 35 days of headroom in steady state (+400 days minus one year). A slow review over the Jan 1 holiday window, or a single missed scheduled run, lets Expires lapse — the opposite of the workflow’s “never silently lapses” goal. The header’s claim that a >1yr bump protects against delay only covers cron slippage, not merge delay or a skipped annual run.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e2a51ca. Configure here.

@cursor cursor Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expires bump exceeds RFC one-year limit

Low Severity

The refresh sets Expires with +400 days (~13 months). RFC 9116 §2.5.5 recommends the value be less than a year into the future. This PR’s goal is RFC conformance for scanners that flag a missing Expires; the automated bump will itself produce values those same tools often warn on.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e2a51ca. Configure here.

sed -i "s/^Expires:.*/Expires: ${new}/I" "$SECURITY_TXT"

@cursor cursor Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expires bump drifts each cycle

Low Severity

The bump sets Expires to today plus 365 days whenever the current value is within 30 days, rather than advancing the existing Expires value by a year. With the monthly-on-the-1st cron, that early window makes the anniversary shift about a month earlier each cycle, so the automated PR does not actually extend the prior expiry by one year.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0679b62. Configure here.

Comment on lines +28 to +34

@avivkeller avivkeller Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As Cursor said, we should bump the in-place year, not re-calculate a date, e.g. Expiry: \d{4} gets replaced by (v) => v + 1


- name: Create Pull Request (only if the date changed)

@avivkeller avivkeller Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: Create Pull Request (only if the date changed)
- name: Open pull request

Conformity with our other workflows. No need to add the (...), this will always bump the date

uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b # v1.10.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
commit-message: 'chore: refresh security.txt Expires'
title: 'chore: refresh security.txt Expires'
body: |
Annual refresh of the `Expires` field in `apps/site/public/.well-known/security.txt` so it
never silently lapses.

**Before merging, please confirm the rest of the file is still accurate:**
- The `Contact` (HackerOne) is still the correct, actively-monitored channel
- The linked `Policy` is still the intended vulnerability-disclosure path

If anything has changed, update it in this PR before extending the expiration.

cc: @nodejs/security-wg
labels: security
branch: automated/security-txt-expiry
Comment on lines +41 to +55

@avivkeller avivkeller Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
commit-message: 'chore: refresh security.txt Expires'
title: 'chore: refresh security.txt Expires'
body: |
Annual refresh of the `Expires` field in `apps/site/public/.well-known/security.txt` so it
never silently lapses.
**Before merging, please confirm the rest of the file is still accurate:**
- The `Contact` (HackerOne) is still the correct, actively-monitored channel
- The linked `Policy` is still the intended vulnerability-disclosure path
If anything has changed, update it in this PR before extending the expiration.
cc: @nodejs/security-wg
labels: security
branch: automated/security-txt-expiry
update-pull-request-title-and-body: true
branch: chore/update-security-txt
body: |
Updates the `Expiry` on our [`security.txt`](https://nodejs.org/.well-known/security.txt] from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}
Before merging, please explicitly confirm that:
- The security contact listed is still correct and actively monitored
- The linked security policy is still accurate
- The project's preferred vulnerability disclosure path has not changed
cc @nodejs/security-wg
Check this workflow's logs at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.
commit-message: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'
title: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'
draft: true

For conformity

1 change: 1 addition & 0 deletions apps/site/public/.well-known/security.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
Contact: https://hackerone.com/nodejs
Expires: 2027-06-30T23:59:59.000Z
Policy: https://github.com/nodejs/node/security/policy#security