Add security documentation, remove /_static directory

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+All versions of Dub are currently being supported with security updates.
+
+## Reporting a Vulnerability
+
+To report a vulnerability, send an email to [email protected].
+
+We will respond within 48 hours acknowledging your report with details about next steps and potential rewards/compensation for responsible disclosure.

apps/web/app/app.dub.co/(dashboard)/[slug]/page-client.tsx

@@ -200,7 +200,7 @@ const MoreLinkOptions = () => {
                   text="Import from Bitly"
                   icon={
                     <img
-                      src="/_static/icons/bitly.svg"
+                      src="https://assets.dub.co/misc/icons/bitly.svg"
                       alt="Bitly logo"
                       className="h-4 w-4"
                     />
@@ -218,7 +218,7 @@ const MoreLinkOptions = () => {
                   text="Import from Rebrandly"
                   icon={
                     <img
-                      src="/_static/icons/rebrandly.svg"
+                      src="https://assets.dub.co/misc/icons/rebrandly.svg"
                       alt="Rebrandly logo"
                       className="h-4 w-4"
                     />
@@ -236,7 +236,7 @@ const MoreLinkOptions = () => {
                   text="Import from Short.io"
                   icon={
                     <img
-                      src="/_static/icons/short.svg"
+                      src="https://assets.dub.co/misc/icons/short.svg"
                       alt="Short.io logo"
                       className="h-4 w-4"
                     />

apps/web/middleware.ts

@@ -23,10 +23,9 @@ export const config = {
      * 1. /api/ routes
      * 2. /_next/ (Next.js internals)
      * 3. /_proxy/ (proxies for third-party services)
-     * 4. /_static/ (static files inside /public folder)
-     * 5. Metadata files: favicon.ico, sitemap.xml, robots.txt, manifest.webmanifest, .well-known
+     * 4. Metadata files: favicon.ico, sitemap.xml, robots.txt, manifest.webmanifest, .well-known
      */
-    "/((?!api/|_next/|_proxy/|_static/|favicon.ico|sitemap.xml|robots.txt|manifest.webmanifest|.well-known).*)",
+    "/((?!api/|_next/|_proxy/|favicon.ico|sitemap.xml|robots.txt|manifest.webmanifest|.well-known).*)",
   ],
 };
 

apps/web/public/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: mailto:[email protected]
+Expires: 2034-10-21T23:22:00.000Z
+Preferred-Languages: en
+Canonical: https://dub.co/.well-known/security.txt