chore(security.txt): make compliant by adding an `Expires` field by kobihikri · Pull Request #9005 · nodejs/nodejs.org

kobihikri · 2026-07-14T08:27:21Z

Description

The published security.txt at https://nodejs.org/.well-known/security.txt currently contains only:

Contact: https://hackerone.com/nodejs
Policy: https://github.com/nodejs/node/security/policy#security

RFC 9116 §2.5.5 states the Expires field MUST be present. Without it, a scanner or security researcher following the RFC has no signed expiry to validate the file against (some tooling flags a security.txt with no Expires as non-conformant).

This PR adds the single missing field:

 Contact: https://hackerone.com/nodejs
+Expires: 2027-06-30T23:59:59.000Z
 Policy: https://github.com/nodejs/node/security/policy#security

I set the value roughly a year out. Since a static date will itself lapse eventually, you may want to automate the refresh — glad to wire that up in a follow-up, but I kept this change scoped to the one missing mandatory field.

Check List

I have read the Contributing Guidelines and made my commit messages conform to the DCO (Signed-off-by).
Change is limited to a single concern.

I used AI assistance to help identify and draft this; I verified the RFC reference and the live file myself and take responsibility for the change. Thank you for maintaining nodejs.org.

RFC 9116 section 2.5.5 states the Expires field MUST be present in a security.txt file. The published file at nodejs.org/.well-known/security.txt currently has only Contact and Policy, so a scanner or researcher following the RFC has no signed expiry to validate the file against. This adds an Expires value roughly a year out. Renewing it (or automating the refresh) keeps the file trustworthy per the RFC; happy to wire that up if you prefer, but kept this change to the single missing field. Signed-off-by: kobihikri <kobi.hikri@gmail.com>

vercel · 2026-07-14T08:27:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Jul 14, 2026 4:37pm

cursor · 2026-07-14T08:27:29Z

PR Summary

Low Risk
Static disclosure metadata plus a low-privilege scheduled PR workflow; no runtime app or auth changes.

Overview
Brings the published security.txt in line with RFC 9116 by adding the mandatory Expires field (2027-06-30T23:59:59.000Z); Contact and Policy are unchanged.

Adds Refresh security.txt Expires, a yearly (Jan 1) workflow—also runnable via workflow_dispatch—that updates Expires to roughly 400 days ahead and opens a PR on automated/security-txt-expiry for human review of contact/policy before merge. It only runs for the nodejs org owner and follows the same pinned gr2m/create-or-update-pull-request-action pattern as other maintenance workflows.

^{Reviewed by Cursor Bugbot for commit e2a51ca. Bugbot is set up for automated code reviews on this repo. Configure here.}

bmuenzenmeyer · 2026-07-14T10:55:40Z

@nodejs/security-wg should own this file and i's changes

bjohansebas

Hmm, I think we should have some automation to update that automatically. I feel like that field is going to be forgotten, and we don't want to show that it's expired when all the other information is actually up to date.

cc: @nodejs/web-infra

MattIPv4 · 2026-07-14T16:05:58Z

👍 Agreed, a once-per-year cron to open a PR to bump it would be nice. That'll prompt folks to actually review the information is still correct before the date is bumped.

bjohansebas · 2026-07-14T16:15:17Z

@kobihikri Something like that could help you build it https://github.com/expressjs/expressjs.com/blob/main/.github/workflows/update-external-docs.yml#L13-L57

kobihikri · 2026-07-14T16:15:31Z

I can take on this PR, but I’m not familiar with your internal rules. Can I take the PR? Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Matt Cowley ***@***.***> Sent: Tuesday, 14 July 2026 19:06:23 To: nodejs/nodejs.org ***@***.***> Cc: Kobi Hikri ***@***.***>; Author ***@***.***> Subject: Re: [nodejs/nodejs.org] security.txt: add required Expires field (PR #9005) [https://avatars.githubusercontent.com/u/12371363?s=20&v=4]MattIPv4 left a comment (nodejs/nodejs.org#9005)<#9005 (comment)> 👍 Agreed, a once-per-year cron to open a PR to bump it would be nice. That'll prompt folks to actually review the information is still correct before the date is bumped. — Reply to this email directly, view it on GitHub<#9005?email_source=notifications&email_token=ABB2WAJ2BKCTD6KFKSX52WD5EZK77A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJXGEZTGMBZG432M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4971330977>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABB2WAM5TC2DCFLGASWME6T5EZK77AVCNFSNUABEKJSXA33TNF2G64TZHMZTONZRG42DONB3JFZXG5LFHM2DQOBRGI3TIMJYGWQXMAQ>. You are receiving this because you authored the thread.Message ID: ***@***.***>

kobihikri · 2026-07-14T16:16:37Z

I’m on it.

…

On Tue, 14 Jul 2026 at 19:15 Kobi Hikri ***@***.***> wrote: *kobihikri* left a comment (nodejs/nodejs.org#9005) <#9005 (comment)> I can take on this PR, but I’m not familiar with your internal rules. Can I take the PR? Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: Matt Cowley ***@***.***> Sent: Tuesday, 14 July 2026 19:06:23 To: nodejs/nodejs.org ***@***.***> Cc: Kobi Hikri ***@***.***>; Author ***@***.***> Subject: Re: [nodejs/nodejs.org] security.txt: add required Expires field (PR #9005) [https://avatars.githubusercontent.com/u/12371363?s=20&v=4]MattIPv4 left a comment (nodejs/nodejs.org#9005)< #9005 (comment)> 👍 Agreed, a once-per-year cron to open a PR to bump it would be nice. That'll prompt folks to actually review the information is still correct before the date is bumped. — Reply to this email directly, view it on GitHub< #9005?email_source=notifications&email_token=ABB2WAJ2BKCTD6KFKSX52WD5EZK77A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJXGEZTGMBZG432M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4971330977>, or unsubscribe< https://github.com/notifications/unsubscribe-auth/ABB2WAM5TC2DCFLGASWME6T5EZK77AVCNFSNUABEKJSXA33TNF2G64TZHMZTONZRG42DONB3JFZXG5LFHM2DQOBRGI3TIMJYGWQXMAQ>. You are receiving this because you authored the thread.Message ID: ***@***.***> — Reply to this email directly, view it on GitHub <#9005?email_source=notifications&email_token=ABB2WAKACI3J7R6NFCVETND5EZMDZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJXGE2DCOJZHA22M4TFMFZW63VNPFXXK4S7MFRXI2LWNF2HTJLFOZSW45FMMZXW65DFOJPWG3DJMNVQ#issuecomment-4971419985>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABB2WAK3MR6LSQAOJS2SLO35EZMDZAVCNFSNUABEKJSXA33TNF2G64TZHMZTONZRG42DONB3JFZXG5LFHM2DQOBRGI3TIMJYGWQXMAQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

Addresses review feedback that a static Expires field will be forgotten and silently expire. Monthly job: if Expires is within 30 days, bump it a year and open a PR for a human to confirm the contact/policy are still valid. Modeled on expressjs/expressjs.com's update-external-docs workflow (as suggested in review) and uses the same gr2m/create-or-update-pull-request-action pin this repo already uses. Assisted by an AI tool; verified myself. Signed-off-by: Kobi Hikri <kobi.hikri@gmail.com>

kobihikri · 2026-07-14T16:29:20Z

Good call, and thanks for the pointer @bjohansebas — you're right that a static Expires will drift and eventually show as expired.

I've pushed a workflow modeled on the expressjs.com one you linked: .github/workflows/security-txt-expiry.yml. It runs monthly (and on demand), and when Expires is within 30 days it bumps it a year out and opens a PR — deliberately a PR, not a direct commit, so a human confirms the Contact/Policy are still correct before the extension lands (it cc's @nodejs/security-wg for that). It uses the same gr2m/create-or-update-pull-request-action pin this repo already uses in create-release-post.yml, and pins actions/checkout to a SHA.

Happy to adjust the cadence, the labels, or hand the workflow off to @nodejs/web-infra if you'd prefer it live somewhere else or be shaped differently — whatever fits the repo's conventions.

cursor · 2026-07-14T16:32:29Z

+        run: |
+          set -euo pipefail
+          new=$(date -u -d '+365 days' +%Y-%m-%dT23:59:59.000Z)
+          sed -i "s/^Expires:.*/Expires: ${new}/I" "$SECURITY_TXT"


Expires bump drifts each cycle

Low Severity

The bump sets Expires to today plus 365 days whenever the current value is within 30 days, rather than advancing the existing Expires value by a year. With the monthly-on-the-1st cron, that early window makes the anniversary shift about a month earlier each cycle, so the automated PR does not actually extend the prior expiry by one year.

Additional Locations (1)

.github/workflows/security-txt-expiry.yml#L32-L34

^{Reviewed by Cursor Bugbot for commit 0679b62. Configure here.}

Per review: switch from a monthly 'within 30 days -> today+365' check (which drifts the window earlier each cycle) to a once-a-year cron that always sets Expires ~13 months out. The >1yr window means the file never expires between runs, and the yearly PR prompts a human to re-confirm the contact/policy. Signed-off-by: Kobi Hikri <kobi.hikri@gmail.com>

kobihikri · 2026-07-14T16:37:05Z

Thanks @MattIPv4 — that's exactly the intent. And good catch on the drift (via the bot review): I've reworked it into a once-a-year cron that always sets Expires ~13 months out (a >1-year window, so the file can't lapse even if a run is delayed), instead of the monthly "within 30 days → today+365" check that crept the window earlier each cycle.

It still opens a PR rather than committing directly, so a human re-confirms the Contact/Policy are still valid before the bump lands, and it cc's @nodejs/security-wg per @bmuenzenmeyer's point about ownership. Happy to adjust the cadence further or hand the workflow off to the security-wg to own.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e2a51ca. Configure here.}

cursor · 2026-07-14T16:39:17Z

+          SECURITY_TXT: apps/site/public/.well-known/security.txt
+        run: |
+          set -euo pipefail
+          new=$(date -u -d '+400 days' +%Y-%m-%dT23:59:59.000Z)


Yearly refresh leaves thin expiry buffer

Medium Severity

The yearly cron plus a human-merge PR only leaves about 35 days of headroom in steady state (+400 days minus one year). A slow review over the Jan 1 holiday window, or a single missed scheduled run, lets Expires lapse — the opposite of the workflow’s “never silently lapses” goal. The header’s claim that a >1yr bump protects against delay only covers cron slippage, not merge delay or a skipped annual run.

^{Reviewed by Cursor Bugbot for commit e2a51ca. Configure here.}

cursor · 2026-07-14T16:39:17Z

+          SECURITY_TXT: apps/site/public/.well-known/security.txt
+        run: |
+          set -euo pipefail
+          new=$(date -u -d '+400 days' +%Y-%m-%dT23:59:59.000Z)


Expires bump exceeds RFC one-year limit

Low Severity

The refresh sets Expires with +400 days (~13 months). RFC 9116 §2.5.5 recommends the value be less than a year into the future. This PR’s goal is RFC conformance for scanners that flag a missing Expires; the automated bump will itself produce values those same tools often warn on.

^{Reviewed by Cursor Bugbot for commit e2a51ca. Configure here.}

avivkeller · 2026-07-14T19:20:55Z

+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0


Run pinact -u on this file, please

avivkeller · 2026-07-14T19:21:40Z

+# Refreshes apps/site/public/.well-known/security.txt so its RFC 9116 Expires
+# field never silently lapses. Runs once a year and opens a PR bumping Expires
+# ~13 months out — a human must confirm the contact/policy are still valid
+# before merging. The generous window (>1yr) means the file never expires even
+# if a run is delayed, and anchoring to the fixed yearly run avoids drift.


Suggested change

# Refreshes apps/site/public/.well-known/security.txt so its RFC 9116 Expires

# field never silently lapses. Runs once a year and opens a PR bumping Expires

# ~13 months out — a human must confirm the contact/policy are still valid

# before merging. The generous window (>1yr) means the file never expires even

# if a run is delayed, and anchoring to the fixed yearly run avoids drift.

# Security Notes

# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions)

# for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions.

# REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!!

# AUTHORS, please only use actions with explicit SHA references, and avoid using `@master` or `@main` references or `@version` tags.

avivkeller · 2026-07-14T19:22:40Z

Let's call this bump-security-txt-expiry.yml so it's clear this bumps it

avivkeller · 2026-07-14T19:23:51Z

+      - name: Bump Expires (~13 months out)
+        env:
+          SECURITY_TXT: apps/site/public/.well-known/security.txt
+        run: |
+          set -euo pipefail
+          new=$(date -u -d '+400 days' +%Y-%m-%dT23:59:59.000Z)
+          sed -i "s/^Expires:.*/Expires: ${new}/I" "$SECURITY_TXT"


As Cursor said, we should bump the in-place year, not re-calculate a date, e.g. Expiry: \d{4} gets replaced by (v) => v + 1

avivkeller · 2026-07-14T19:24:16Z

+          new=$(date -u -d '+400 days' +%Y-%m-%dT23:59:59.000Z)
+          sed -i "s/^Expires:.*/Expires: ${new}/I" "$SECURITY_TXT"
+
+      - name: Create Pull Request (only if the date changed)


Suggested change

- name: Create Pull Request (only if the date changed)

- name: Open pull request

Conformity with our other workflows. No need to add the (...), this will always bump the date

avivkeller · 2026-07-14T19:27:34Z

+          commit-message: 'chore: refresh security.txt Expires'
+          title: 'chore: refresh security.txt Expires'
+          body: |
+            Annual refresh of the `Expires` field in `apps/site/public/.well-known/security.txt` so it
+            never silently lapses.
+
+            **Before merging, please confirm the rest of the file is still accurate:**
+            - The `Contact` (HackerOne) is still the correct, actively-monitored channel
+            - The linked `Policy` is still the intended vulnerability-disclosure path
+
+            If anything has changed, update it in this PR before extending the expiration.
+
+            cc: @nodejs/security-wg
+          labels: security
+          branch: automated/security-txt-expiry


Suggested change

commit-message: 'chore: refresh security.txt Expires'

title: 'chore: refresh security.txt Expires'

body: |

Annual refresh of the `Expires` field in `apps/site/public/.well-known/security.txt` so it

never silently lapses.

**Before merging, please confirm the rest of the file is still accurate:**

- The `Contact` (HackerOne) is still the correct, actively-monitored channel

- The linked `Policy` is still the intended vulnerability-disclosure path

If anything has changed, update it in this PR before extending the expiration.

cc: @nodejs/security-wg

labels: security

branch: automated/security-txt-expiry

update-pull-request-title-and-body: true

branch: chore/update-security-txt

body: |

Updates the `Expiry` on our [`security.txt`](https://nodejs.org/.well-known/security.txt] from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}

Before merging, please explicitly confirm that:

- The security contact listed is still correct and actively monitored

- The linked security policy is still accurate

- The project's preferred vulnerability disclosure path has not changed

cc @nodejs/security-wg

Check this workflow's logs at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.

commit-message: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'

title: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'

draft: true

For conformity

kobihikri requested a review from a team as a code owner July 14, 2026 08:27

vercel Bot deployed to Preview July 14, 2026 08:28 View deployment

AugustinMauroy approved these changes Jul 14, 2026

View reviewed changes

bmuenzenmeyer mentioned this pull request Jul 14, 2026

Add security.txt to CODEOWNERS #9006

Open

5 tasks

bjohansebas reviewed Jul 14, 2026

View reviewed changes

kobihikri requested a review from a team as a code owner July 14, 2026 16:29

vercel Bot deployed to Preview July 14, 2026 16:30 View deployment

cursor Bot reviewed Jul 14, 2026

View reviewed changes

vercel Bot deployed to Preview July 14, 2026 16:37 View deployment

cursor Bot reviewed Jul 14, 2026

View reviewed changes

flakey5 approved these changes Jul 14, 2026

View reviewed changes

flakey5 requested a review from a team July 14, 2026 16:40

avivkeller reviewed Jul 14, 2026

View reviewed changes

avivkeller changed the title ~~security.txt: add required Expires field~~ chore(security.txt): make compliant by adding an Expires field Jul 14, 2026

	- name: Create Pull Request (only if the date changed)
	- name: Open pull request

-          commit-message: 'chore: refresh security.txt Expires'
-          title: 'chore: refresh security.txt Expires'
-          body: |
-            Annual refresh of the `Expires` field in `apps/site/public/.well-known/security.txt` so it
-            never silently lapses.
-            **Before merging, please confirm the rest of the file is still accurate:**
-            - The `Contact` (HackerOne) is still the correct, actively-monitored channel
-            - The linked `Policy` is still the intended vulnerability-disclosure path
-            If anything has changed, update it in this PR before extending the expiration.
-            cc: @nodejs/security-wg
-          labels: security
-          branch: automated/security-txt-expiry
+         update-pull-request-title-and-body: true
+          branch: chore/update-security-txt
+          body: |
+            Updates the `Expiry` on our [`security.txt`](https://nodejs.org/.well-known/security.txt] from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}
+            Before merging, please explicitly confirm that:
+            - The security contact listed is still correct and actively monitored
+            - The linked security policy is still accurate
+            - The project's preferred vulnerability disclosure path has not changed
+            cc @nodejs/security-wg
+            Check this workflow's logs at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}.
+          commit-message: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'
+          title: 'meta: update security `Expiry` from ${{ steps.update-expiry.outputs.old }} to ${{ steps.update-expiry.outputs.new }}'
+          draft: true

Uh oh!

Conversation

kobihikri commented Jul 14, 2026

Description

Check List

Uh oh!

vercel Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

bmuenzenmeyer commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bjohansebas left a comment

Choose a reason for hiding this comment

Uh oh!

MattIPv4 commented Jul 14, 2026

Uh oh!

bjohansebas commented Jul 14, 2026

Uh oh!

kobihikri commented Jul 14, 2026 via email

Uh oh!

kobihikri commented Jul 14, 2026 via email

Uh oh!

kobihikri commented Jul 14, 2026

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Expires bump drifts each cycle

Uh oh!

kobihikri commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Yearly refresh leaves thin expiry buffer

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Expires bump exceeds RFC one-year limit

Uh oh!

avivkeller Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

avivkeller Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

vercel Bot commented Jul 14, 2026 •

edited

Loading

cursor Bot commented Jul 14, 2026 •

edited

Loading

bmuenzenmeyer commented Jul 14, 2026 •

edited

Loading

avivkeller Jul 14, 2026 •

edited

Loading