web-security-map VS security-txt

Take a look at one of my Makefiles[0]. It uses most features Make has to offer (to much so). It doesn't matter what state you start from, fresh clones repo or outdated virtualenv. Running `make run` will do everything needed to run the application instance, `make test` will run the testsuite. Each command is it's own "functional" block of shell script with it's inputs (prerequisites) and outputs (target). All recipies will run in Bash on all system btw, see the first line of the Makefile.

Still, a Makefile with only targets, no prerequisites is less cruft than a Bash script with a switch statement. But eventually your (team) needs will grow and you start to introduce more logic and dependencies. This is where Make shines for me.

[0] https://gitlab.com/internet-cleanup-foundation/web-security-...

A very, very long article to say "you should have a security.txt file, find an example at https://securitytxt.org/".

https://www.shopify.com/.well-known/security.txt (https://securitytxt.org/ standard)

You are looking in the wrong place. https://securitytxt.org/ proposes to create a text file called security.txt under the .well-known directory of your project.

So, the URL becomes:

This is great. Would you please also implement RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116 or https://securitytxt.org) and give ever security researcher the chance to get in contact with you.

security.txt https://github.com/securitytxt/security-txt :

> security.txt provides a way for websites to define security policies. The security.txt file sets clear guidelines for security researchers on how to report security issues. security.txt is the equivalent of robots.txt, but for security issues.

Carbon.txt:

> A proposed convention for website owners and digital service providers to demonstrate that their digital infrastructure runs on green electricity.

"Work out how to make it discoverable - well-known, TXT records or root domains" https://github.com/thegreenwebfoundation/carbon.txt/issues/3... re: JSON-LD instead of txt, signed records with W3C Verifiable Credentials (and blockerts/cert-verifier-js)