Skip to content

Feat: Add RFC 9116 compliant security.txt Cloudflare Worker Template#1058

Open
MOBILEPHONE wants to merge 1 commit into
cloudflare:mainfrom
MOBILEPHONE:main
Open

Feat: Add RFC 9116 compliant security.txt Cloudflare Worker Template#1058
MOBILEPHONE wants to merge 1 commit into
cloudflare:mainfrom
MOBILEPHONE:main

Conversation

@MOBILEPHONE

Copy link
Copy Markdown

Hi Cloudflare Team,

I am submitting a community-driven, enterprise-grade template (security-txt-template) to help developers easily deploy RFC 9116-compliant vulnerability disclosure policies at the edge.

This is especially vital for developers hosting on static CMS platforms (such as Blogger, Shopify, Webflow, or Wix) where uploading custom files to the root /.well-known/ directory is restricted.

Features Included:

  • ⚙️ Dynamic Auto-Expiration: Automatically calculates and updates the mandatory "Expires:" date to exactly 1 year in the future, making the file completely maintenance-free.
  • 🔐 Dual Route Serving: Supports serving both your raw security policy (/.well-known/security.txt) and its cryptographic PGP signature (/.well-known/security.txt.sig) natively.
  • 🌐 Global CORS & Security Headers: Enforces wildcard CORS headers, allowing automated global compliance scanners and vulnerability crawlers to parse your security files cleanly without being blocked by browser-level cross-origin security policies.

I have fully validated, tested, and formatted this template locally inside our development environments. I look forward to your review and feedback!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant