document RFC-9116 via CycloneDX

[jkowalleck]

RFC-9116 is

A File Format to Aid in Security Vulnerability Disclosure

Abstract

When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.

see https://datatracker.ietf.org/doc/html/rfc9116
see also https://github.com/securitytxt/security-txt

example document:

Contact: https://hackerone.com/github
Acknowledgments: https://hackerone.com/github/hacktivity
Preferred-Languages: en
Canonical: https://github.com/.well-known/security.txt
Policy: https://bounty.github.com
Hiring: https://github.careers
Expires: 2024-03-17T14:09:14z

---

Request

Add a type of externalReference that is specific for referencing a document that complies with RFC 9116

suggestion: the enum value should be 'rfc-9116'

---

Alternatives

• Store the information statically in the document (registered properties or dedicated first-party-fields)
  • not feasible because the data might expire or get updated upstream, without a notice to the owner of a CycloneDX document. Therefore, static information is state-ful and would prevent timely updates. see https://www.rfc-editor.org/rfc/rfc9116#name-incorrect-or-stale-informat
• use existing external reference type "security-contact".
  • possible, but could be improved, since the RFC describes a parsable data format, not just arbitrary text written for humans.