sentry.io serves no /.well-known/security.txt (RFC 9116)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 23m
- Merged PRs (30d)
- 607
Description
https://sentry.io/.well-known/security.txt returns 404. RFC 9116 defines /.well-known/security.txt as the standard, machine-discoverable pointer to a project's vulnerability-reporting process. Sentry has a security program, but there's no security.txt advertising it at the well-known path.
Raising as an issue since the site isn't in this repo. A small security.txt (Contact → your security intake, future Expires, Policy) would resolve it.
I used AI assistance to investigate and draft this; I reproduced the 404 myself.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing RFC 9116 and the security program referenced in the issue; the requested change is outside this repository. Confirm that https://sentry.io/.well-known/security.txt serves a valid document containing Contact, a future Expires value, and Policy instead of returning 404.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100