[P1] Audit: Missing security.txt for vulnerability disclosure

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: Trust Center references GitHub Security Advisories or the repository issue process, but the site does not clearly expose a standard /.well-known/security.txt file. Security researchers and automated scanners look for this file first.

Affected URLs:

• https://byteflow.tools/.well-known/security.txt
• https://byteflow.tools/security.txt
• https://byteflow.tools/en/trust-center

Reproduction steps:

1. Open /.well-known/security.txt.
2. Open /security.txt.
3. Compare results with Trust Center vulnerability reporting guidance.
4. Check whether contact, policy, preferred languages, and canonical fields are available.

Expected behavior: a standards-aligned security.txt should be available and link to the vulnerability reporting path.

Actual behavior: vulnerability guidance exists in Trust Center, but a standard security.txt endpoint is not clearly available.

Impact: security reporters may use public issues incorrectly, include sensitive data in public reports, or abandon responsible disclosure.

Proposed fix:

• Add /.well-known/security.txt.
• Include Contact, Policy, Preferred-Languages, Canonical, and Expires fields.
• Link Policy to Trust Center or GitHub Security Advisories.
• Add robots/sitemap consideration if needed.
• Add CI test to ensure the file exists and returns 200.

Acceptance criteria:

• /.well-known/security.txt returns 200 with valid fields.
• Trust Center links to the same policy.
• The file avoids asking reporters to disclose secrets publicly.
• Security scanners detect the reporting path.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.