Add a .well-known/security.txt

pydotorg/tests/test_views.py

@@ -51,3 +51,12 @@ def test_legacy_sponsor_redirects(self):
                     status_code=301,
                     fetch_redirect_response=False,
                 )
+
+    def test_security_txt(self):
+        response = self.client.get("/.well-known/security.txt")
+        self.assertEqual(response.status_code, 200)
+        body = response.content.decode()
+        self.assertIn("Contact: https://www.python.org/dev/security/", body)
+
+        response = self.client.get("/security.txt")
+        self.assertRedirects(response, "/.well-known/security.txt", status_code=301, fetch_redirect_response=False)

pydotorg/urls.py

@@ -22,6 +22,13 @@
     path("release-edit-button/<int:pk>", ReleaseEditButton.as_view(), name="release_edit_button"),
     path("humans.txt", TemplateView.as_view(template_name="humans.txt", content_type="text/plain")),
     path("robots.txt", TemplateView.as_view(template_name="robots.txt", content_type="text/plain")),
+    path(
+        ".well-known/security.txt",
+        TemplateView.as_view(template_name="security.txt", content_type="text/plain"),
+        name="security_txt",
+    ),
+    # RFC 9116 legacy location; redirect to the canonical path.
+    path("security.txt", RedirectView.as_view(pattern_name="security_txt", permanent=True)),
     path("funding.json", views.serve_funding_json, name="funding_json"),
     path("shell/", TemplateView.as_view(template_name="python/shell.html"), name="shell"),
     # python section landing pages

templates/security.txt

@@ -0,0 +1,6 @@
+# Security contact information for python.org.
+Contact: https://www.python.org/dev/security/
+Expires: 2030-11-10T00:00:00.000Z
+Policy: https://www.python.org/dev/security/
+Preferred-Languages: en
+Canonical: https://www.python.org/.well-known/security.txt