README

Statamic addon that serves /.well-known/security.txt (RFC 9116) from a regular global set.

Own menu entry — Tools → security.txt opens the form directly; the entry is removed from the Globals menu. Technically the content lives in the global set security_txt, so it is edited, localized, versioned and permissioned like any other global (the entry is shown to users who may view that global set).
Confirmed validity — Expires is one year after the details were last confirmed (built on mindtwo/base-security-txt). The last field of the form is the fieldtype security_txt_confirm: it shows the validity and a Confirm details button (Statamic's own button component in Statamic 6) that renews the saved details for one year. Save stores changes and keeps the date; the very first save publishes the file.
Reminder — from 30 days before expiry, opening the dashboard shows a Statamic toast to users who may edit the global set.
Validation — RFC 9116 rules on save (https only, valid e-mail addresses and language codes), with field errors in the control panel.
Dashboard widget (optional) — validity per site with a link to the edit page.
Fields — Contact (one per line: e-mail, + phone number or https URL), Policy, Encryption, Acknowledgments, Hiring, Preferred languages. Canonical is added automatically on https.
Without a contact the URL answers 404; /security.txt redirects (301) to the well-known path. Both routes bypass static caching.
English and German interface.

Installation

composer require mindtwo/statamic-security-txt
php please security-txt:install

The install command creates the global set and its blueprint for every site (safe to run again). The fieldtype's script is published to public/vendor/statamic-security-txt on install; after updates run php artisan vendor:publish --tag=statamic-security-txt --force if the button is missing. Field labels are written in the application locale; pass --locale=de for German labels. Then open Tools → security.txt in the control panel, enter the contact and save.

To show the widget, add it to config/statamic/cp.php:

'widgets' => [
    ['type' => 'security_txt', 'width' => 50],
],

Requirements: Statamic 5 or 6, PHP 8.2+.

Multi-site

The file belongs to the host. The addon resolves the site from the request URL, so sites on their own domains each serve their own file, while sites that share a domain under a path prefix (/en) share the file of the site at the domain root. Localizations inherit empty fields from their origin.

Notes

A physical file public/.well-known/security.txt wins over the addon; delete it.
Responses are sent with Cache-Control: public, max-age=3600, so a CDN shows changes within an hour at the latest.
The confirmation time is stored as confirmed_at in the global set's data and is not part of the blueprint.

Development

composer install
composer check   # pint --test, phpstan (level 8), pest

Inside the monorepo the core resolves through the path repository base-security-txt; CI removes it when the package is built standalone.

License

MIT, see LICENSE.md.

mindtwo / statamic-security-txt

Package info

Security

Statistics