From f8afce71a103b9d72f9bd69a55dfdfa569824431 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <stan@python.org>
Date: Fri, 30 Oct 2026 11:57:50 +0000
Subject: [PATCH] Add a `.well-known/security.txt` to python.org

---
 pydotorg/tests/test_views.py | 9 +++++++++
 pydotorg/urls.py             | 7 +++++++
 templates/security.txt       | 6 ++++++
 3 files changed, 22 insertions(+)
 create mode 100644 templates/security.txt

diff --git a/pydotorg/tests/test_views.py b/pydotorg/tests/test_views.py
index ab46855d4..1fc1bed50 100644
--- a/pydotorg/tests/test_views.py
+++ b/pydotorg/tests/test_views.py
@@ -51,3 +51,12 @@ def test_legacy_sponsor_redirects(self):
                     status_code=301,
                     fetch_redirect_response=False,
                 )
+
+    def test_security_txt(self):
+        response = self.client.get("/.well-known/security.txt")
+        self.assertEqual(response.status_code, 200)
+        body = response.content.decode()
+        self.assertIn("Contact: https://www.python.org/dev/security/", body)
+
+        response = self.client.get("/security.txt")
+        self.assertRedirects(response, "/.well-known/security.txt", status_code=301, fetch_redirect_response=False)
diff --git a/pydotorg/urls.py b/pydotorg/urls.py
index 38b0968d4..6f740a337 100644
--- a/pydotorg/urls.py
+++ b/pydotorg/urls.py
@@ -22,6 +22,13 @@
     path("release-edit-button/<int:pk>", ReleaseEditButton.as_view(), name="release_edit_button"),
     path("humans.txt", TemplateView.as_view(template_name="humans.txt", content_type="text/plain")),
     path("robots.txt", TemplateView.as_view(template_name="robots.txt", content_type="text/plain")),
+    path(
+        ".well-known/security.txt",
+        TemplateView.as_view(template_name="security.txt", content_type="text/plain"),
+        name="security_txt",
+    ),
+    # RFC 9116 legacy location; redirect to the canonical path.
+    path("security.txt", RedirectView.as_view(pattern_name="security_txt", permanent=True)),
     path("funding.json", views.serve_funding_json, name="funding_json"),
     path("shell/", TemplateView.as_view(template_name="python/shell.html"), name="shell"),
     # python section landing pages
diff --git a/templates/security.txt b/templates/security.txt
new file mode 100644
index 000000000..e734018f9
--- /dev/null
+++ b/templates/security.txt
@@ -0,0 +1,6 @@
+# Security contact information for python.org.
+Contact: https://www.python.org/dev/security/
+Expires: 2030-11-10T00:00:00.000Z
+Policy: https://www.python.org/dev/security/
+Preferred-Languages: en
+Canonical: https://www.python.org/.well-known/security.txt