From b6adcf50c66ee77b04d25e307cc87827cfb94e21 Mon Sep 17 00:00:00 2001
From: Geoffrey Huntley <ghuntley@ghuntley.com>
Date: Tue, 6 Dec 2022 08:43:00 +1000
Subject: [PATCH] feat(securitytxt): add security.txt (#5827)

---
 src/browser/security.txt | 6 ++++++
 src/node/routes/index.ts | 7 +++++++
 2 files changed, 13 insertions(+)
 create mode 100644 src/browser/security.txt

diff --git a/src/browser/security.txt b/src/browser/security.txt
new file mode 100644
index 000000000..18996f284
--- /dev/null
+++ b/src/browser/security.txt
@@ -0,0 +1,6 @@
+Contact: mailto:security@coder.com
+Acknowledgments: https://coder.com/security/thanks
+Preferred-Languages: en-US
+Canonical: https://coder.com/.well-known/security.txt
+Policy: https://coder.com/security/policy
+Hiring: https://coder.com/careers
\ No newline at end of file
diff --git a/src/node/routes/index.ts b/src/node/routes/index.ts
index a2046b6a7..96928493b 100644
--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -81,6 +81,13 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
       return res.redirect(`https://${req.headers.host}${req.originalUrl}`)
     }
 
+    // Return security.txt.
+    if (req.originalUrl === "/security.txt" || req.originalUrl === "/.well-known/security.txt") {
+      const resourcePath = path.resolve(rootPath, "src/browser/security.txt")
+      res.set("Content-Type", getMediaMime(resourcePath))
+      return res.send(await fs.readFile(resourcePath))
+    }
+
     // Return robots.txt.
     if (req.originalUrl === "/robots.txt") {
       const resourcePath = path.resolve(rootPath, "src/browser/robots.txt")