chore: add security.txt + robots.txt; document DMARC/AI Labyrinth remediation#189
Conversation
…teps Addresses Cloudflare Security Insights findings for oullin.io: - Security.txt not configured -> add public/.well-known/security.txt (RFC 9116) served by Caddy via a new `handle /.well-known/*` block in both WebCaddyfile.internal and WebCaddyfile.local (static, no SPA fallback). - Add public/robots.txt (Disallow: /seo) to complement Cloudflare AI Labyrinth. - Add tests/caddy coverage for the new /.well-known route. - docs/cloudflare-security-insights.md: runbook for the DNS/dashboard items (DMARC TXT record, AI Labyrinth toggle) that cannot be fixed in code. The API repo needs no changes: its Caddyfile.prod is the public edge and proxies all non-/api paths to web:80, so the web container serves these files.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses three low-severity security findings identified by Cloudflare. It implements necessary static file configurations for security and SEO compliance while providing a comprehensive runbook for non-code remediation steps such as DNS updates and dashboard settings. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis change adds HTTP routing for ChangesWell-Known Path Serving and Security Metadata
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures Caddy to serve static files under the /.well-known/ path (such as security.txt) without falling back to the Single Page Application (SPA) routing. It adds the security.txt and robots.txt files, includes a test to verify the Caddy configuration, and provides a remediation runbook document for Cloudflare Security Insights. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/cloudflare-security-insights.md`:
- Line 40: The markdown line containing "Start with `p=none` (monitor only).
DMARC only *passes* if SPF and/or DKIM are configured for the" uses asterisks
for emphasis which is drifting the formatter; update that token to the
formatter's expected emphasis style (e.g., replace *passes* with _passes_ or run
the repository markdown formatter like Prettier/markdownlint and commit the
formatted output) and commit the resulting change so the linter no longer
produces a dirty diff.
- Around line 34-38: The fenced DNS example block containing the lines "Type:
TXT", "Name: _dmarc", and "Value: v=DMARC1; p=none;
rua=mailto:gustavoocanto@gmail.com; fo=1" is missing a language tag; update the
opening triple-backtick fence to include a language (for example "txt") so the
block becomes ```txt which will satisfy markdownlint MD040.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ccc528e3-c195-44af-bf9e-9152f6916fde
📒 Files selected for processing (6)
caddy/WebCaddyfile.internalcaddy/WebCaddyfile.localdocs/cloudflare-security-insights.mdpublic/.well-known/security.txtpublic/robots.txttests/caddy/web-caddyfile.test.ts
- Add 'txt' language tag to the DMARC fenced block (markdownlint MD040). - Normalize emphasis to underscores via oxfmt (fixes CI format diff).
1 participant
Why
Cloudflare Security Insights flagged three Low-severity findings for
oullin.io(
Cloudflare_Ollin_SecurityInsights_20260604_1635.csv):Only #1 is a true code change here. This site is not on Cloudflare Pages — it's a Vue/Vite SPA served by Caddy in Docker, behind the Cloudflare proxy. #2 is a DNS record and #3 is a dashboard toggle, so those are documented rather than coded.
What changed (repo)
public/.well-known/security.txt(RFC 9116). Contact:gustavoocanto@gmail.com,Expires: 2027-06-05.handle /.well-known/*block inWebCaddyfile.internal(prod) andWebCaddyfile.local(dev) so the file is served as statictext/plain, never SPA-fallback'd toindex.html. robots.txt needed no Caddy change — existing@robotsrules +try_files {path}already cover it.public/robots.txt(Disallow: /seo) to complement AI Labyrinth.tests/caddy/web-caddyfile.test.ts: assert the new/.well-knownstatic route.docs/cloudflare-security-insights.md: runbook for the manual DNS/dashboard items (exact DMARC TXT record + AI Labyrinth toggle).API repo
Checked
~/Sites/oullin/api— no changes needed. ItsCaddyfile.prodis the public TLS edge and proxies all non-/apipaths toweb:80, so the web container serves/.well-known/security.txtand/robots.txt. The API also sends no email, so DMARC doesn't apply there.Manual follow-ups (not in this PR — see the runbook doc)
_dmarc=v=DMARC1; p=none; rua=mailto:gustavoocanto@gmail.com; fo=1in Cloudflare DNS, then tighten to quarantine/reject after monitoring.Verification
npm run build→dist/.well-known/security.txtanddist/robots.txtpresent. ✅vite preview→ both return200Content-Type: text/plainwith correct bodies. ✅vitest run tests/caddy/web-caddyfile.test.ts→ 8/8 pass (incl. new assertion). ✅Summary by CodeRabbit
New Features
Documentation
Tests