BF-024-BF-045: Harden security and redaction flows

.github/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+byteflow.tools is a privacy-first, browser-local developer tools project. Most tool payloads should stay in the user's browser and must not be included in public reports.
+
+## Reporting a Vulnerability
+
+Report suspected vulnerabilities privately through GitHub Security Advisories:
+
+https://github.com/baixiangcpp/byteflow.tools/security/advisories/new
+
+Do not open a public issue for exploitable behavior, data exposure, bypasses, or reports that require private reproduction details. Do not include production secrets, API keys, JWTs, certificates, private keys, customer data, logs, HAR files, uploaded files, screenshots with private data, or full request/response bodies.
+
+For non-security bugs and feature requests, use GitHub Issues.
+
+## Supported Version
+
+Security fixes target the hosted site and the current `main` branch.

public/.well-known/security.txt

@@ -0,0 +1,5 @@
+Contact: https://github.com/baixiangcpp/byteflow.tools/security/advisories/new
+Policy: https://github.com/baixiangcpp/byteflow.tools/security/policy
+Canonical: https://byteflow.tools/.well-known/security.txt
+Preferred-Languages: en
+Expires: 2027-06-24T00:00:00Z

public/_redirects

@@ -1,3 +1,4 @@
+/security.txt /.well-known/security.txt 301
 /en/cron-expression-generator /en/crontab-generator 301
 /zh-CN/cron-expression-generator /zh-CN/crontab-generator 301
 /zh-TW/cron-expression-generator /zh-TW/crontab-generator 301

scripts/generators/generate-legacy-routes.js

@@ -9,6 +9,9 @@ const TOOL_ALIASES_PATH = path.join(ROOT, "src/core/registry/tool-aliases.json")
 const REDIRECTS_PATH = path.join(ROOT, "public/_redirects")
 const LOCALES = ["en", "zh-CN", "zh-TW", "ja", "ko", "de", "fr"]
 const REDIRECT_STATUSES = new Set([301, 302])
+const STATIC_REDIRECT_LINES = [
+    "/security.txt /.well-known/security.txt 301",
+]
 const CHECK_ONLY = process.argv.includes("--check")
 
 function readText(filePath) {
@@ -90,6 +93,7 @@ export function loadLegacyTaxonomyRedirects() {
 
 function buildRedirectLines(routes, taxonomyRedirects = loadLegacyTaxonomyRedirects()) {
     return [
+        ...STATIC_REDIRECT_LINES,
         ...routes.flatMap((route) => {
             if (!REDIRECT_STATUSES.has(route.status)) return []
             return LOCALES.map((locale) => `/${locale}/${route.sourceSlug} /${locale}/${route.targetSlug} ${route.status}`)

src/app/[lang]/contact/page.tsx

@@ -3,12 +3,13 @@
 import { useLang } from "@/core/i18n/lang-provider"
 import { toast } from "sonner"
 import { Button } from "@/components/ui/button"
-import { Github, Mail, MessageSquare, ExternalLink } from "lucide-react"
+import { Github, Mail, MessageSquare, ExternalLink, ShieldCheck } from "lucide-react"
 import { safeClipboardWrite } from "@/core/clipboard/clipboard"
 
 const EMAIL_ADDRESS = "contact@byteflow.tools"
 const GITHUB_REPOSITORY_URL = "https://github.com/baixiangcpp/byteflow.tools"
 const GITHUB_ISSUES_URL = "https://github.com/baixiangcpp/byteflow.tools/issues"
+const SECURITY_ADVISORY_URL = "https://github.com/baixiangcpp/byteflow.tools/security/advisories/new"
 
 export default function ContactPage() {
     const { t } = useLang()
@@ -17,6 +18,7 @@ export default function ContactPage() {
     const links = [
         { icon: Github, title: "GitHub", desc: p.contact_github_desc, href: GITHUB_REPOSITORY_URL, external: true },
         { icon: MessageSquare, title: p.contact_issues_title, desc: p.contact_issues_desc, href: GITHUB_ISSUES_URL, external: true },
+        { icon: ShieldCheck, title: p.contact_security_title, desc: p.contact_security_desc, href: SECURITY_ADVISORY_URL, external: true },
     ]
 
     const handleCopyEmail = async () => {
@@ -37,7 +39,7 @@ export default function ContactPage() {
                 <p className="mt-3 text-base leading-relaxed text-muted-foreground">{p.contact_intro}</p>
             </section>
 
-            <section className="grid grid-cols-1 gap-4 sm:grid-cols-3">
+            <section className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
                 {links.map((link) => (
                     <a
                         key={link.title}

src/app/[lang]/trust-center/page.tsx

@@ -1,6 +1,6 @@
 import Link from "next/link"
 import { notFound } from "next/navigation"
-import { CheckCircle2, ExternalLink, Github, LockKeyhole, Network, ShieldCheck, WifiOff } from "lucide-react"
+import { CheckCircle2, ExternalLink, FileText, Github, LockKeyhole, Network, ShieldCheck, WifiOff } from "lucide-react"
 import { isValidLocale, requireTranslationValue } from "@/core/i18n/i18n"
 import { getTranslation } from "@/core/i18n/translations/catalog"
 import { TOOL_REGISTRY } from "@/core/registry"
@@ -9,6 +9,7 @@ import { SITE_URL, buildCanonicalUrl } from "@/core/seo/urls"
 
 const SECURITY_ADVISORY_URL = "https://github.com/baixiangcpp/byteflow.tools/security/advisories/new"
 const GITHUB_REPO_URL = "https://github.com/baixiangcpp/byteflow.tools"
+const SECURITY_TXT_URL = "/.well-known/security.txt"
 
 function TrustPill({
     icon,
@@ -141,6 +142,13 @@ export default async function TrustCenterPage({
                         <Github className="h-4 w-4" aria-hidden="true" />
                         {p.trust_center_source_link}
                     </a>
+                    <a
+                        href={SECURITY_TXT_URL}
+                        className="inline-flex min-h-10 items-center gap-2 rounded-md border border-border/75 bg-background/70 px-3 text-sm font-medium hover:border-primary/35 hover:text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    >
+                        <FileText className="h-4 w-4" aria-hidden="true" />
+                        {p.trust_center_securitytxt_link}
+                    </a>
                 </div>
             </section>
 
@@ -281,6 +289,13 @@ export default async function TrustCenterPage({
                         <Github className="h-4 w-4" aria-hidden="true" />
                         {p.trust_center_source_link}
                     </a>
+                    <a
+                        href={SECURITY_TXT_URL}
+                        className="inline-flex min-h-10 items-center gap-2 rounded-md border border-border/75 bg-background/70 px-3 text-sm font-medium hover:border-primary/35 hover:text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    >
+                        <FileText className="h-4 w-4" aria-hidden="true" />
+                        {p.trust_center_securitytxt_link}
+                    </a>
                 </div>
             </section>
         </div>

src/core/i18n/translations/de.json

@@ -165,6 +165,10 @@
       "hosts_label": "Zielhosts",
       "purpose_label": "Zweck",
       "data_sent_label": "Gesendete Daten",
+      "confirm_title": "Externe Anfrage bestaetigen",
+      "confirm_checkbox": "Mir ist bewusst, dass diese Aktion das angegebene externe Asset aus meinem Browser anfordern kann.",
+      "confirm_rights": "Verwenden Sie nur Assets, die Ihnen gehoeren, fuer die Sie berechtigt sind oder die laut Plattformbedingungen zulaessig sind.",
+      "confirm_required": "Bestaetigen Sie die externe Anfrage vor Vorschau oder Download.",
       "purposes": {
         "authorized_media_download": "Medien von einer von Ihnen angegebenen URL herunterladen, nachdem Sie die Nutzungsberechtigung bestätigt haben.",
         "thumbnail_preview": "Öffentliche Thumbnail-Bild-URLs aus dem eingegebenen Videolink erzeugen und anzeigen."
@@ -1051,7 +1055,10 @@
       "capture_groups_label": "Erfassungsgruppen",
       "group_prefix": "Gruppe",
       "error_invalid_regex": "Ungueltiger regulaerer Ausdruck",
-      "error_match_limit": "Trefferlimit ueberschritten. Der Ausdruck koennte endlos leere Zeichenfolgen finden."
+      "error_match_limit": "Trefferlimit ueberschritten. Der Ausdruck koennte endlos leere Zeichenfolgen finden.",
+      "timing_label": "Dauer: {ms} ms",
+      "evaluating_label": "Wird ausgewertet...",
+      "performance_warning_title": "Leistungswarnung"
     },
     "regex_generator": {
       "title": "Regex-Generator",
@@ -2387,10 +2394,14 @@
       "option_awsAccessKeys": "AWS-Zugriffsschlüssel",
       "option_privateKeys": "Private-Key-Blöcke",
       "option_urlCredentials": "URL-Zugangsdaten",
+      "option_cookies": "Cookie-Header",
+      "option_sessionIds": "Sitzungs- und Anfrage-IDs",
       "scrub_action": "Logs bereinigen",
       "scrubbed": "{count} Wert(e) redigiert",
       "redactions": "Redaktionen",
       "types": "Typen",
+      "summary_title": "Redaktionsübersicht",
+      "manual_review_note": "Automatische Redaktion ist eine Sicherheitsstufe, keine Garantie. Prüfen Sie die bereinigte Ausgabe vor dem Teilen.",
       "findings_title": "Erkannte sensible Werte",
       "table_type": "Typ",
       "table_position": "Originalzeile:Spalte",
@@ -2510,6 +2521,8 @@
       "option_responseContent": "Antwortinhalte",
       "requests": "Anfragen",
       "redactions": "Redaktionen",
+      "summary_title": "Sanitizing-Übersicht",
+      "review_warning": "Der Standardexport redigiert riskante HAR-Felder. Prüfen Sie die bereinigte HAR-Datei vor dem Teilen.",
       "entries_title": "HAR-Einträge",
       "method": "Methode",
       "status": "HTTP-Status",
@@ -2871,11 +2884,14 @@
     "contact_issues_desc": "Erstellen Sie ein GitHub-Issue für Bugmeldungen oder Feature-Anfragen.",
     "contact_email_title": "E-Mail",
     "contact_email_desc": "Für geschäftliche Anfragen oder Partnerschaften kontaktieren Sie uns per E-Mail.",
+    "contact_security_title": "Sicherheitslücke",
+    "contact_security_desc": "Melde vermutete Schwachstellen über GitHub Security Advisories. Füge öffentlichen Issues keine Geheimnisse oder privaten Payloads hinzu.",
     "privacy_external_request_tools_title": "Tools mit externer Anfrage",
     "privacy_external_request_tools_desc": "Diese Liste wird aus Tool-Manifests generiert. Diese Tools kontaktieren die aufgeführten Domains nur für den offengelegten Zweck und erst nach Auswahl der externen Anfrageaktion.",
     "trust_center_title": "Datenschutz- und Vertrauenszentrum",
     "trust_center_intro": "Hier wird erklärt, wie byteflow.tools browser-lokale Tools, externe Anfragen, sensible Eingaben, Speicherung, Analytics, PWA-Cache, Sicherheitsheader und Meldungen von Schwachstellen kennzeichnet.",
     "trust_center_source_link": "Quellcode auf GitHub ansehen",
+    "trust_center_securitytxt_link": "security.txt ansehen",
     "trust_center_summary_local_title": "Local-first Laufzeit",
     "trust_center_summary_local_desc": "Die meisten Tools verarbeiten Eingabe und Ausgabe im Browser. Tools mit externen Anfragen werden vor Netzwerkzugriff gekennzeichnet.",
     "trust_center_summary_network_title": "Transparente Netzwerkzugriffe",
@@ -2910,7 +2926,7 @@
     "trust_center_xss_title": "Darstellung von Nutzerinhalten",
     "trust_center_xss_desc": "Tools mit Vorschau für Markdown, HTML, SVG oder Metadaten sollten nutzergesteuertes Markup bereinigen und CSP nicht lockern, nur damit Vorschauen funktionieren.",
     "trust_center_vulnerability_title": "Meldung von Schwachstellen",
-    "trust_center_vulnerability_desc": "Melde vermutete Schwachstellen über GitHub Security Advisories oder den Issue-Prozess des Repositorys. Füge öffentlichen Meldungen keine Produktionsgeheimnisse oder privaten Payloads hinzu.",
+    "trust_center_vulnerability_desc": "Melde vermutete Schwachstellen über private GitHub Security Advisories. Nutze öffentliche Issues nur für nicht sicherheitsrelevante Bugs oder Feature-Anfragen und füge öffentlichen Meldungen niemals Produktionsgeheimnisse oder private Payloads hinzu.",
     "trust_center_faq_title": "FAQ zum Vertrauenszentrum",
     "trust_center_faq_q1": "Laufen alle Tools vollständig offline?",
     "trust_center_faq_a1": "Nein. Browser-lokale Werkzeuge können nach dem Caching der Assets offline weiterlaufen, aber Werkzeuge mit externer Anfrage benötigen Netzwerkzugriff für die offengelegte Aktion.",

src/core/i18n/translations/en.json

@@ -169,6 +169,10 @@
       "hosts_label": "Hosts",
       "purpose_label": "Purpose",
       "data_sent_label": "Data sent",
+      "confirm_title": "Confirm external request",
+      "confirm_checkbox": "I understand this action may request the disclosed external asset from my browser.",
+      "confirm_rights": "Use only assets you own, are authorized to use, or are allowed to access under the platform terms.",
+      "confirm_required": "Confirm the external request before previewing or downloading.",
       "purposes": {
         "authorized_media_download": "Download media from a URL you provide after you confirm you are allowed to use it.",
         "thumbnail_preview": "Generate and preview public thumbnail image URLs derived from the video link you enter."
@@ -1079,7 +1083,10 @@
       "capture_groups_label": "Capture Groups",
       "group_prefix": "Group",
       "error_invalid_regex": "Invalid regex",
-      "error_match_limit": "Match limit exceeded. The regex may be matching endless zero-length strings."
+      "error_match_limit": "Match limit exceeded. The regex may be matching endless zero-length strings.",
+      "timing_label": "{ms} ms",
+      "evaluating_label": "Evaluating...",
+      "performance_warning_title": "Performance warning"
     },
     "regex_generator": {
       "title": "Regex Generator",
@@ -2407,10 +2414,14 @@
       "option_awsAccessKeys": "AWS access keys",
       "option_privateKeys": "Private key blocks",
       "option_urlCredentials": "URL credentials",
+      "option_cookies": "Cookie headers",
+      "option_sessionIds": "Session and request IDs",
       "scrub_action": "Scrub logs",
       "scrubbed": "{count} item(s) redacted",
       "redactions": "Redactions",
       "types": "Types",
+      "summary_title": "Redaction summary",
+      "manual_review_note": "Automated redaction is a safety layer, not a guarantee. Review the scrubbed output before sharing.",
       "findings_title": "Detected sensitive values",
       "table_type": "Type",
       "table_position": "Original line:column",
@@ -2530,6 +2541,8 @@
       "option_responseContent": "Response content",
       "requests": "Requests",
       "redactions": "Redactions",
+      "summary_title": "Sanitization summary",
+      "review_warning": "Default export redacts risky HAR fields. Review the sanitized HAR before sharing.",
       "entries_title": "HAR entries",
       "method": "Method",
       "status": "Status",
@@ -2871,11 +2884,14 @@
     "contact_issues_desc": "Open a GitHub issue for bug reports or feature requests.",
     "contact_email_title": "Email",
     "contact_email_desc": "For business inquiries or partnership opportunities.",
+    "contact_security_title": "Security vulnerability",
+    "contact_security_desc": "Report suspected vulnerabilities through GitHub Security Advisories. Do not include secrets or private payloads in public issues.",
     "privacy_external_request_tools_title": "External request tools",
     "privacy_external_request_tools_desc": "This list is generated from tool manifests. These tools may contact the listed domains only for the disclosed purpose and only after the external-request action is chosen.",
     "trust_center_title": "Privacy and Trust Center",
     "trust_center_intro": "Understand how byteflow.tools labels browser-local tools, external requests, sensitive inputs, storage, analytics, PWA cache behavior, security headers, and vulnerability reporting.",
     "trust_center_source_link": "View source on GitHub",
+    "trust_center_securitytxt_link": "View security.txt",
     "trust_center_summary_local_title": "Local-first runtime",
     "trust_center_summary_local_desc": "Most tools process input and output in your browser. External-request tools are labeled before network access.",
     "trust_center_summary_network_title": "Network transparency",
@@ -2910,7 +2926,7 @@
     "trust_center_xss_title": "User content rendering",
     "trust_center_xss_desc": "Tools that preview Markdown, HTML, SVG, or metadata should sanitize user-controlled markup and avoid relaxing CSP to make previews work.",
     "trust_center_vulnerability_title": "Vulnerability reporting",
-    "trust_center_vulnerability_desc": "Report suspected vulnerabilities through GitHub Security Advisories or the repository issue process. Do not include production secrets or private payloads in public reports.",
+    "trust_center_vulnerability_desc": "Report suspected vulnerabilities through private GitHub Security Advisories. Use public issues only for non-security bugs or feature requests, and never include production secrets or private payloads in public reports.",
     "trust_center_faq_title": "Trust Center FAQ",
     "trust_center_faq_q1": "Do all tools run completely offline?",
     "trust_center_faq_a1": "No. Browser-local tools can continue offline after assets are cached, but tools marked External request need network access for the disclosed action.",