Serve /.well-known/security.txt (RFC 9116) (#117)

ddiff --git a/server/http/discovery.js b/server/http/discovery.js
iindex f8f8605..47ce9b0 100644
---- a/server/http/discovery.js
++++ b/server/http/discovery.js
@@@ -21,6 +21,9 @@ const sharedSeo = require('openvibe-shared/seo');
  const cache = require('openvibe-shared/cache-policy');
  const { SITE_SUMMARY } = require('../render/layout');
  
++// The date /.well-known/security.txt must be refreshed by: one year on, a person re-reads and re-commits it.
++const SECURITY_EXPIRES = '2027-10-29T00:00:00.000Z';
++
  function createDiscoveryRoutes({ config, store, blogs, publication, reading }) {
      const router = express.Router();
      const { db } = store;
@@@ -56,6 +59,21 @@ function createDiscoveryRoutes({ config, store, blogs, publication, reading }) {
          res.type('text/plain').set('Cache-Control', cache.htmlHeaders({ maxAge: 3600 })).send(body);
      });
  
++    // /.well-known/security.txt (RFC 9116, SEO-30). Contact, Expires and Canonical are required; Canonical is
++    // this site's own, from the config, never a constant. Policy is listed only while
++    // https://openvibe.network/security answers 200 (checked 2026-10-29). Expires is the date the file must be
++    // refreshed by: one year on, a person re-reads and re-commits it.
++    router.get('/.well-known/security.txt', (_req, res) => {
++        res.type('text/plain; charset=utf-8').set('Cache-Control', 'public, max-age=86400').send([
++            'Contact: mailto:[email protected]',
++            `Expires: ${SECURITY_EXPIRES}`,
++            'Preferred-Languages: en',
++            `Canonical: ${abs('/.well-known/security.txt')}`,
++            'Policy: https://openvibe.network/security',
++            '',
++        ].join('\n'));
++    });
++
      router.get('/llms.txt', async (_req, res) => {
          const official = await blogs.official();
          res.type('text/plain').set('Cache-Control', cache.htmlHeaders({ maxAge: 3600 })).send(sharedSeo.llmsTxt({
ddiff --git a/test/seed-ops.test.js b/test/seed-ops.test.js
iindex 175fd8d..c86c3ed 100644
---- a/test/seed-ops.test.js
++++ b/test/seed-ops.test.js
@@@ -82,6 +82,25 @@ const { seedOfficialPost, loadFacts, SLUG } = require('../server/seed');
          assert.match(idx, /sitemaps\/posts\.xml/);
      });
  
++    await check('security.txt: RFC 9116, canonical to this site, valid for a year', async () => {
++        const r = await t.get('/.well-known/security.txt');
++        assert.strictEqual(r.status, 200);
++        assert.strictEqual(r.headers.get('content-type'), 'text/plain; charset=utf-8');
++        assert.strictEqual(r.headers.get('cache-control'), 'public, max-age=86400');
++        const fields = new Map();
++        for (const line of r.text.split('\n')) if (line.trim()) {
++            const m = line.match(/^([A-Za-z-]+): (.+)$/);
++            assert.ok(m, `every security.txt line is "Name: value" (got "${line}")`);
++            fields.set(m[1], m[2]);
++        }
++        for (const key of ['Contact', 'Expires', 'Preferred-Languages', 'Canonical', 'Policy']) assert.ok(fields.has(key), `security.txt names ${key}`);
++        assert.strictEqual(fields.get('Contact'), 'mailto:[email protected]');
++        assert.ok(Date.parse(fields.get('Expires')) > Date.now(), 'Expires is in the future');
++        const canonical = new URL(fields.get('Canonical'));
++        assert.strictEqual(canonical.host, 'openvibe.blog', 'Canonical is this site\'s own host');
++        assert.strictEqual(canonical.pathname, '/.well-known/security.txt');
++    });
++
      await check('llms-full.txt lists only indexable posts as summary text, within maxBytes, never the body', async () => {
          const full = await t.get('/llms-full.txt');
          assert.strictEqual(full.status, 200);