Add /.well-known/security.txt (RFC 9116)

[kobihikri]

What

Add /.well-known/security.txt so the site serves one at the location RFC 9116 defines.

Why

https://docs.gofiber.io/.well-known/security.txt currently returns 404. RFC 9116 makes /.well-known/security.txt the standard, machine-discoverable place a security researcher (or automated tooling) looks first to learn how to report an issue. The file is added under the site's static directory (served verbatim), points Contact at the project's GitHub Security Advisory intake, and carries a future Expires per §2.5.5.

I used AI assistance to help identify this and draft the file; I verified the RFC reference and the live 404 myself and take responsibility for it.

Summary by CodeRabbit

• Documentation
  • Added a security disclosure policy file with reporting contact details, supported language information, expiration metadata, and a canonical reference URL.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b555c6e3-3b11-493a-a27d-d6dc120a0a0d

📥 Commits

Reviewing files that changed from the base of the PR and between 04de807 and 9cfc380.

📒 Files selected for processing (1)

• static/.well-known/security.txt

📜 Recent review details

🔇 Additional comments (2)

static/.well-known/security.txt (2)

1-4: LGTM!

---

2-2: 🔒 Security & Privacy

Verify the expiration window at publication.

RFC 9116 recommends an Expires value less than one year in the future. This timestamp exceeds that window if published before 2026-07-14T00:00:00Z; use a deployment-relative renewal process if necessary. (rfc-editor.org)

---

📝 Walkthrough

Walkthrough

Adds static/.well-known/security.txt with security disclosure contact, expiration, language, and canonical URL metadata.

Changes

Security disclosure

Layer / File(s)	Summary
Security.txt metadata static/.well-known/security.txt	Adds Contact, Expires, Preferred-Languages, and Canonical fields for security disclosure metadata.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit hops through fields so neat,
Security paths are clear and sweet.
Contact, language, date in line,
A canonical link to shine.
“Safe burrows!” cheers the bunny bright.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is clear, but it doesn't follow the repository's required PR template or include the template's notice.	Rewrite the PR description to match the repository template and include any required sections or notices before resubmitting.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding security.txt at /.well-known for RFC 9116 compliance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}