Modrinth

Author	SHA1	Message	Date
Prospector	1b08d2741b	Merge remote-tracking branch 'origin/main' into security-txt	2025-07-09 15:50:02 -07:00
Erb3	e35981e4aa	Merge branch 'main' into security-txt	2025-03-12 20:50:25 +01:00
Erb3	4f3b4a55e2	docs(frontend) careers link in security.txt Signed-off-by: Erb3 <49862976+Erb3@users.noreply.github.com>	2025-03-12 20:50:15 +01:00
Erb3	51c3797456	Merge branch 'main' into security-txt	2025-01-17 16:33:07 +01:00
Erb3	5f3200ce43	fix(frontend): extend security.txt expiry It takes so long to merge the PR :( Signed-off-by: Erb3 <49862976+Erb3@users.noreply.github.com>	2025-01-17 16:32:55 +01:00
Erb3	c4b0f7dcd1	Merge branch 'main' into security-txt	2024-12-07 10:37:07 +01:00
Erb3	c6dee57c40	Merge branch 'main' into security-txt	2024-10-24 17:56:21 +02:00
Erb3	8f29da5739	Merge branch 'main' into security-txt	2024-10-22 21:23:52 +02:00
Erb3	0bc5e954e4	Merge branch 'main' into security-txt	2024-10-20 18:04:58 +02:00
Erb3	7a3ca5fb45	Merge branch 'main' into security-txt	2024-08-26 20:46:33 +02:00
Erb3	28adcdd401	Merge branch 'main' into security-txt	2024-08-25 09:55:12 +02:00
Erb3	414bcaf348	fix(docs): reduce security.txt expiry This addresses a concern where the security.txt has a long expiration date. Someone could treat this as "use this until then", which we don't want since it's a long time. The specification recommends no longer than one year, as it is to mark as stale. From the RFC: > The "Expires" field indicates the date and time after which the data contained in the "security.txt" file is considered stale and should not be used (as per Section 5.3). The value of this field is formatted according to the Internet profiles of [ISO.8601-1] and [ISO.8601-2] as defined in [RFC3339]. It is RECOMMENDED that the value of this field be less than a year into the future to avoid staleness. Signed-off-by: Erb3 <49862976+Erb3@users.noreply.github.com>	2024-08-22 19:10:51 +02:00
Erb3	727b00855e	feat: add security.txt Security.txt is a well-known (pun intended) file among security researchers, so they don't have to go scavenging for your security information. More information is available on [securitytxt.org](https://securitytxt.org/). I've set the following values: - The email to contact with issues, `jai@modrinth.com`. This is the email stated in the security policy. If you wish to not include it here due to spam, you should also not have it as a `mailto` link in the security policy. - Expiry is set to 2030. By this time Modrinth has become the biggest Minecraft mod distributor, and having expanded into other games. By this time they should also have updated this file. - English is the preferred language - The file is located at modrinth.com/.well-known/security.txt - The security policy is at https://modrinth.com/legal/security The following values have been left unset: - PGP key, not sure where this would be located, if there is one - Acknowledgments. Modrinth does currently not have a site for thanks - Hiring, as it wants security-related positions - CSAF, a Common Security Advisory Framework ?	2024-08-22 17:30:32 +02:00

1 changed files with 6 additions and 0 deletions

6

apps/frontend/src/public/.well-known/security.txt Normal file

View File

 @ -0,0 +1,6 @@
 Contact: mailto:jai@modrinth.com
 Expires: 2025-12-31T00:00:00.000Z
 Preferred-Languages: en
 Canonical: https://modrinth.com/.well-known/security.txt
 Policy: https://modrinth.com/legal/security
 Hiring: https://careers.modrinth.com/

Compare commits

13 Commits

main ... security-t

6

apps/frontend/src/public/.well-known/security.txt Normal file

View File

Compare commits

13 Commits main ... security-t

6 apps/frontend/src/public/.well-known/security.txt Normal file Unescape Escape View File

13 Commits

main ... security-t

6

apps/frontend/src/public/.well-known/security.txt Normal file

View File