search

sesh / ready

Are you production ready?
ISC License
26 stars 4 forks source link

'Expires' timestamp not checked in 'security.txt'? #18

Closed mejofi closed 5 months ago

mejofi commented 5 months ago

Version: 1.1.1

As far as I can tell, the 'Security.txt exists and is a text file that contains required attributes' test does not check if the 'Expires' line, which is required by spec, isn't in the past.

Example; Expires: 2024-02-09T22:59:00.000Z passes with an OK, despite being expired, and should therefore not be considered production ready?

Don't know how difficult it is to add this, but it would be appreciated as an extra check 🙂

This is with a 'security.txt' generated via https://securitytxt.org

sesh commented 5 months ago

This is a great suggestion. I've added a quick check and created a sample domain for testing: securitytxt-expired-test.b5n.sh

sesh commented 5 months ago 
> ready securitytxt-expired-test.b5n.sh | grep -i "security.txt"
[ OK ] Security.txt exists and is a text file that contains required attributes
[FAIL] Security.txt has an expiry date in the future (2023-01-01 00:00:00+00:00)
mejofi commented 5 months ago

Shiny! Thanks 🙂