add security.txt disclosure policy

[AmanVarshney01]

Summary

• Add a static security.txt at /.well-known/security.txt for responsible disclosure discovery.
• Include Prisma security contact, canonical URL, preferred language, expiry, and policy link.

Validation

• Ran git diff --check --cached before commit.
• Confirmed the staged diff only added apps/site/public/.well-known/security.txt.

Notes

• No build run; this is a static public asset only.

Summary by CodeRabbit

• New Features
  • Added a standardized, publicly-accessible security resource containing vulnerability reporting channels, security contact information, and links to security policies, enabling security researchers to easily identify and use appropriate channels for responsible vulnerability disclosure.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blog	Ready	Preview, Comment	Apr 29, 2026 8:58am
docs	Ready	Preview, Comment	Apr 29, 2026 8:58am
eclipse	Ready	Preview, Comment	Apr 29, 2026 8:58am
site	Ready	Preview, Comment	Apr 29, 2026 8:58am

[coderabbitai]

Walkthrough

A new .well-known/security.txt file is added to the public directory, publishing the security contact email, expiration metadata, language preference, canonical URL, and reference to the security policy to enable vulnerability disclosure coordination.

Changes

Cohort / File(s)	Summary
Security Configuration apps/site/public/.well-known/security.txt	Introduces a standard security disclosure file with contact information (mailto:security@prisma.io), expiration timestamp, language preference, canonical URL, and link to the security policy in the prisma/prisma repository.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'add security.txt disclosure policy' clearly and concisely describes the main change: adding a security.txt file for responsible disclosure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Review rate limit: 4/5 reviews remaining, refill in 12 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	⚠️ Changes detected (Review)	1 changed	Apr 29, 2026, 9:05 AM

[coderabbitai]

🧹 Nitpick comments (1)

apps/site/public/.well-known/security.txt (1)

1-5: Consider adding an Encryption field for secure communications.

RFC 9116 recommends including an Encryption field with a link to your PGP key to enable security researchers to send encrypted vulnerability reports. This enhances the security of your disclosure process.

Example addition:

 Contact: mailto:security@prisma.io
+Encryption: https://www.prisma.io/.well-known/pgp-key.txt
 Expires: 2027-04-28T00:00:00Z

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/site/public/.well-known/security.txt` around lines 1 - 5, Add an
Encryption field to the security.txt to enable encrypted vulnerability reports:
include either a direct URL to your public OpenPGP/PGP key (e.g. Encryption:
https://example.com/pgp-key.txt) or a clear OpenPGP key fingerprint (e.g.
Encryption: OpenPGP: 0123 4567 89AB CDEF 0123 4567 89AB CDEF0123 4567) in the
same file (security.txt) so researchers can send encrypted reports; ensure the
URL is reachable and the key format is a standard PGP public key.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@apps/site/public/.well-known/security.txt`:
- Around line 1-5: Add an Encryption field to the security.txt to enable
encrypted vulnerability reports: include either a direct URL to your public
OpenPGP/PGP key (e.g. Encryption: https://example.com/pgp-key.txt) or a clear
OpenPGP key fingerprint (e.g. Encryption: OpenPGP: 0123 4567 89AB CDEF 0123 4567
89AB CDEF0123 4567) in the same file (security.txt) so researchers can send
encrypted reports; ensure the URL is reachable and the key format is a standard
PGP public key.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 34d238fe-aa78-4796-8c9f-4a4306cabfd3

📥 Commits

Reviewing files that changed from the base of the PR and between 0b7278c and b911916.

📒 Files selected for processing (1)

• apps/site/public/.well-known/security.txt

[carlagn]

lgtm