diff --git a/docs/test/001-security-txt/01-curl-security-txt.txt b/docs/test/001-security-txt/01-curl-security-txt.txt
new file mode 100644
index 00000000000..5ad96963d1c
--- /dev/null
+++ b/docs/test/001-security-txt/01-curl-security-txt.txt
@@ -0,0 +1,8 @@
+HTTP/1.1 200 OK
+Content-Type: text/plain; charset=utf-8
+Set-Cookie: shop_session-id=a58b718d-cbf3-4842-9d71-157cb61986c0; Max-Age=172800
+Date: Mon, 20 Jul 2026 12:43:01 GMT
+Content-Length: 67
+
+Contact: mailto:security@example.com
+Expires: 2027-01-20T12:43:01Z
diff --git a/docs/test/001-security-txt/02-home-sanity.txt b/docs/test/001-security-txt/02-home-sanity.txt
new file mode 100644
index 00000000000..7131799e8bd
--- /dev/null
+++ b/docs/test/001-security-txt/02-home-sanity.txt
@@ -0,0 +1,292 @@
+HTTP/1.1 200 OK
+Set-Cookie: shop_session-id=71f1d4ac-aec0-45f6-ad4f-d9f13f48bb6b; Max-Age=172800
+Date: Mon, 20 Jul 2026 12:43:04 GMT
+Content-Type: text/html; charset=utf-8
+Transfer-Encoding: chunked
+
+
+
+
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
+    <meta http-equiv="X-UA-Compatible" content="ie=edge">
+    <title>
+        
+        Online Boutique
+        
+    </title>
+    <link href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB"
+        crossorigin="anonymous">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap" rel="stylesheet">
+    <link href="https://fonts.googleapis.com/css2?family=Google+Symbols:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200" rel="stylesheet" />
+    <link rel="stylesheet" type="text/css" href="/static/styles/styles.css">
+    <link rel="stylesheet" type="text/css" href="/static/styles/cart.css">
+    <link rel="stylesheet" type="text/css" href="/static/styles/order.css">
+    <link rel="stylesheet" type="text/css" href="/static/styles/bot.css">
+    
+    <link rel='shortcut icon' type='image/x-icon' href='/static/favicon.ico' />
+    
+</head>
+
+<body>
+    <header>
+        
+        <div class="navbar sub-navbar">
+            <div class="container d-flex justify-content-between">
+                <a href="/" class="navbar-brand d-flex align-items-center">
+                    
+                    <img src="/static/icons/Hipster_NavLogo.svg" alt="" class="top-left-logo" />
+                    
+                </a>
+                <div class="controls">
+
+                    
+                    <div class="h-controls">
+                        <div class="h-control">
+                            <span class="icon currency-icon"> $</span>
+                            <form method="POST" class="controls-form" action="/setCurrency" id="currency_form" >
+                                <select name="currency_code" onchange="document.getElementById('currency_form').submit();">
+                                        
+                                    <option value="EUR" >EUR</option>
+                                    
+                                    <option value="USD" selected="selected">USD</option>
+                                    
+                                    <option value="JPY" >JPY</option>
+                                    
+                                    <option value="GBP" >GBP</option>
+                                    
+                                    <option value="TRY" >TRY</option>
+                                    
+                                    <option value="CAD" >CAD</option>
+                                    
+                                </select>
+                            </form>
+                            <img src="/static/icons/Hipster_DownArrow.svg" alt="" class="icon arrow" />
+                        </div>
+                    </div>
+                    
+
+                    
+
+                    <a href="/cart" class="cart-link">
+                        <img src="/static/icons/Hipster_CartIcon.svg" alt="Cart icon" class="logo" title="Cart" />
+                        
+                    </a>
+                </div>
+            </div>
+        </div>
+
+    </header>
+    
+<div  class="local" >
+  <span class="platform-flag">
+    local
+  </span>
+</div>
+<main role="main" class="home">
+
+  
+  <div class="home-mobile-hero-banner d-lg-none"></div>
+
+  <div class="container-fluid">
+    <div class="row">
+
+      
+      
+      
+      
+
+      <div class="col-12 col-lg-12 px-10-percent">
+
+        <div class="row hot-products-row px-xl-6">
+
+          <div class="col-12">
+            <h3>Hot Products</h3>
+          </div>
+
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/OLJCESPC7Z">
+              <img loading="lazy" src="/static/img/products/sunglasses.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Sunglasses</div>
+              <div class="hot-product-card-price">$19.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/66VCHSJNUP">
+              <img loading="lazy" src="/static/img/products/tank-top.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Tank Top</div>
+              <div class="hot-product-card-price">$18.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/1YMWWN1N4O">
+              <img loading="lazy" src="/static/img/products/watch.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Watch</div>
+              <div class="hot-product-card-price">$109.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/L9ECAV7KIM">
+              <img loading="lazy" src="/static/img/products/loafers.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Loafers</div>
+              <div class="hot-product-card-price">$89.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/2ZYFJ3GM2N">
+              <img loading="lazy" src="/static/img/products/hairdryer.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Hairdryer</div>
+              <div class="hot-product-card-price">$24.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/0PUK6V6EV0">
+              <img loading="lazy" src="/static/img/products/candle-holder.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Candle Holder</div>
+              <div class="hot-product-card-price">$18.99</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/LS4PSXUNUM">
+              <img loading="lazy" src="/static/img/products/salt-and-pepper-shakers.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Salt &amp; Pepper Shakers</div>
+              <div class="hot-product-card-price">$18.49</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/9SIQT8TOJO">
+              <img loading="lazy" src="/static/img/products/bamboo-glass-jar.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Bamboo Glass Jar</div>
+              <div class="hot-product-card-price">$5.49</div>
+            </div>
+          </div>
+          
+          <div class="col-md-4 hot-product-card">
+            <a href="/product/6E92ZMYYFZ">
+              <img loading="lazy" src="/static/img/products/mug.jpg">
+              <div class="hot-product-card-img-overlay"></div>
+            </a>
+            <div>
+              <div class="hot-product-card-name">Mug</div>
+              <div class="hot-product-card-price">$8.99</div>
+            </div>
+          </div>
+          
+
+        </div>
+
+        
+        <div class="row d-none d-lg-block home-desktop-footer-row">
+          <div class="col-12 p-0">
+            
+
+<footer class="py-5">
+    <div class="footer-top">
+        <div class="container footer-social">
+            <p class="footer-text">This website is hosted for demo purposes only. It is not an actual shop. This is not a Google product.</p>
+            <p class="footer-text">© 2020-2026 Google LLC (<a href="https://github.com/GoogleCloudPlatform/microservices-demo">Source Code</a>)</p>
+            <p class="footer-text">
+                <small>
+                    session-id: 71f1d4ac-aec0-45f6-ad4f-d9f13f48bb6b — 
+                    request-id: a96844e6-7da3-47c2-ba9e-51639c2ffbd5
+                </small>
+                <br/>
+                <small>
+                    
+                    Deployment details are still loading.
+                    Try refreshing this page.
+                    
+                </small>
+            </p>
+        </div>
+    </div>
+</footer>
+<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.1.1/js/bootstrap.min.js"
+    integrity="sha384-smHYKdLADwkXOn1EmN1qk/HfnUcbVRZyYmZ4qpPea6sjB/pTJ0euyQp0Mk8ck+5T" crossorigin="anonymous">
+</script>
+</body>
+
+</html>
+
+          </div>
+        </div>
+
+      </div>
+
+    </div>
+  </div>
+
+</main>
+
+
+<div class="d-lg-none">
+  
+
+<footer class="py-5">
+    <div class="footer-top">
+        <div class="container footer-social">
+            <p class="footer-text">This website is hosted for demo purposes only. It is not an actual shop. This is not a Google product.</p>
+            <p class="footer-text">© 2020-2026 Google LLC (<a href="https://github.com/GoogleCloudPlatform/microservices-demo">Source Code</a>)</p>
+            <p class="footer-text">
+                <small>
+                    session-id: 71f1d4ac-aec0-45f6-ad4f-d9f13f48bb6b — 
+                    request-id: a96844e6-7da3-47c2-ba9e-51639c2ffbd5
+                </small>
+                <br/>
+                <small>
+                    
+                    Deployment details are still loading.
+                    Try refreshing this page.
+                    
+                </small>
+            </p>
+        </div>
+    </div>
+</footer>
+<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.1.1/js/bootstrap.min.js"
+    integrity="sha384-smHYKdLADwkXOn1EmN1qk/HfnUcbVRZyYmZ4qpPea6sjB/pTJ0euyQp0Mk8ck+5T" crossorigin="anonymous">
+</script>
+</body>
+
+</html>
+
+</div>
+
diff --git a/docs/test/001-security-txt/summary.md b/docs/test/001-security-txt/summary.md
new file mode 100644
index 00000000000..13492ddb637
--- /dev/null
+++ b/docs/test/001-security-txt/summary.md
@@ -0,0 +1,97 @@
+# Live e2e smoke — unit 001-security-txt (service: frontend)
+
+**Branch:** work/001-security-txt
+**Verdict: PASS**
+
+## What was proven
+`GET /.well-known/security.txt` on the live, freshly-deployed `frontend` service returns HTTP 200,
+`Content-Type: text/plain; charset=utf-8`, a `Contact: mailto:security@example.com` line, and
+exactly one `Expires:` line with an RFC 3339 timestamp ~6 months in the future. The storefront
+home page still serves 200 after the redeploy.
+
+## Bring-up (why this is a real test, not the stale pod)
+The running `frontend` pod predated the change (image built ~4 days ago, no new endpoint), so the
+following was done before smoking the endpoint:
+
+1. `docker build -t frontend:e2e-001-securitytxt src/frontend` — **PASS**, image built successfully
+   from the current `work/001-security-txt` source (Go build completed, image exported as
+   `frontend:e2e-001-securitytxt`).
+2. `kind load docker-image frontend:e2e-001-securitytxt --name boutique` — **PASS**, image loaded
+   onto node `boutique-control-plane`.
+3. `kubectl set image deployment/frontend server=frontend:e2e-001-securitytxt` (container name
+   confirmed via `kubectl get deployment frontend -o jsonpath='{.spec.template.spec.containers[*].name}'`
+   → `server`) — **PASS**, deployment updated.
+4. `kubectl rollout status deployment/frontend --timeout=180s` — **PASS**:
+   ```
+   deployment.apps/frontend image updated
+   Waiting for deployment "frontend" rollout to finish: 1 old replicas are pending termination...
+   deployment "frontend" successfully rolled out
+   ```
+   New pod `frontend-567f6d6bbb-kwjjq` came up `Running 1/1` on the new image (confirms the kind
+   node pulled the locally-loaded image, not a stale cached one — otherwise the rollout would have
+   stuck on `ImagePullBackOff`).
+5. `kubectl port-forward deployment/frontend 8080:8080` (backgrounded) — **PASS**, forwarding
+   established (`Forwarding from [::1]:8080 -> 8080`).
+
+## Step 1 — `GET /.well-known/security.txt` — PASS
+
+**Input sent:**
+```
+curl -isS http://localhost:8080/.well-known/security.txt
+```
+
+**Observed output** (full response, see [`01-curl-security-txt.txt`](./01-curl-security-txt.txt)):
+```
+HTTP/1.1 200 OK
+Content-Type: text/plain; charset=utf-8
+Set-Cookie: shop_session-id=a58b718d-cbf3-4842-9d71-157cb61986c0; Max-Age=172800
+Date: Mon, 20 Jul 2026 12:43:01 GMT
+Content-Length: 67
+
+Contact: mailto:security@example.com
+Expires: 2027-01-20T12:43:01Z
+```
+
+Assertion checks:
+- **Status 200** — PASS (`HTTP/1.1 200 OK`).
+- **`Content-Type: text/plain; charset=utf-8`** — PASS, present verbatim in headers.
+- **Body contains `Contact: mailto:security@example.com`** — PASS, present verbatim in body.
+- **Exactly one `Expires:` line, RFC 3339, in the future (~6 months out)** — PASS.
+  `grep -c '^Expires:'` → `1`. Value `2027-01-20T12:43:01Z` parses as RFC 3339 (`YYYY-MM-DDTHH:MM:SSZ`).
+  Current time at capture was `2026-07-20T12:43:10Z` (via `date -u`), so the `Expires` value is
+  ~6 months in the future, consistent with the expected ~6-month-out policy.
+
+## Step 2 — Storefront sanity (`GET /`) — PASS
+
+**Input sent:**
+```
+curl -isS http://localhost:8080/
+```
+
+**Observed output** (see [`02-home-sanity.txt`](./02-home-sanity.txt), truncated to headers +
+top of body):
+```
+HTTP/1.1 200 OK
+Set-Cookie: shop_session-id=71f1d4ac-aec0-45f6-ad4f-d9f13f48bb6b; Max-Age=172800
+Date: Mon, 20 Jul 2026 12:43:04 GMT
+Content-Type: text/html; charset=utf-8
+Transfer-Encoding: chunked
+
+<!DOCTYPE html>
+<html lang="en">
+...
+<title>
+    Online Boutique
+```
+
+- **Status 200, HTML storefront rendered** — PASS. Confirms the redeploy of the new frontend
+  image did not break the app.
+
+## Cleanup
+The backgrounded `kubectl port-forward` process was terminated after capturing evidence
+(`pkill -f "kubectl port-forward deployment/frontend"`); no forwarding left running.
+
+## Conclusion
+All 4 required assertions on `/.well-known/security.txt` hold, and the storefront home page still
+serves correctly after the frontend was rebuilt/redeployed from the `work/001-security-txt`
+branch. **Verdict: PASS.**
diff --git a/docs/test/README.md b/docs/test/README.md
index 71c78499e29..46d024659ba 100644
--- a/docs/test/README.md
+++ b/docs/test/README.md
@@ -4,11 +4,16 @@ The `e2e-tester` subagent follows THIS file to prove a change works against the
 system. It is the contract: prerequisites, entry point, exact steps, expected results,
 troubleshooting. Evidence + `summary.md` go to `docs/test/NNN-<slug>/`.
 
-> **Current status: e2e is `n/a` for now.** The app only runs on a Kubernetes cluster via Skaffold
-> — there is no lightweight local run — and this repo does not yet pin a reliable local cluster. Until
-> someone stands one up and fills the per-service subsections below, `work-plan` should declare
-> `e2e: n/a — no running cluster wired yet` for units whose change is covered by build + unit tests.
-> The routed quality gate (`.claude/quality-gate.routes`) is the mechanical floor in the meantime.
+> **Current status: e2e is `n/a` by default, but the `frontend` path is now proven.** The app only
+> runs on a Kubernetes cluster via Skaffold — there is no lightweight local run — and this repo does
+> not pin a reliable local cluster for every service. Unit 001-security-txt did exercise a real live
+> smoke against a local `kind` cluster (`kind-boutique`): image rebuilt, `kind load`ed, rolled out,
+> port-forwarded, curled — see `docs/test/001-security-txt/`. So units touching **`frontend`** can
+> attempt a real live smoke against a local kind cluster per the subsection below, rather than
+> defaulting to `e2e: n/a`. Other services still need their subsections filled and a cluster
+> available; for those, `work-plan` should keep declaring `e2e: n/a — no running cluster wired yet`
+> for units covered by build + unit tests. The routed quality gate (`.claude/quality-gate.routes`)
+> is the mechanical floor in the meantime.
 
 ## Prerequisites (shared bring-up, once wired)
 - A Kubernetes cluster: local (`minikube start` / `kind create cluster`) or remote (GKE).
@@ -43,7 +48,12 @@ the frontend flows or via direct gRPC calls (`grpcurl`) against a port-forwarded
      Capture `02-cart.png`.
   3. Complete checkout with test card data → order-confirmation page with an order ID. Capture
      `03-order-confirmation.png`.
-- **Expected verdict:** PASS = browse → cart → checkout completes with no 5xx and correct totals.
+  4. Curl the well-known security endpoint: `curl -isS http://localhost:8080/.well-known/security.txt`
+     → `200`, `Content-Type: text/plain; charset=utf-8`, a `Contact:` line, and exactly one future
+     RFC 3339 `Expires:` line. Capture the raw response to a text file (it's an HTTP resource, not a
+     page, so a curl transcript stands in for the screenshot).
+- **Expected verdict:** PASS = browse → cart → checkout completes with no 5xx and correct totals, and
+  `/.well-known/security.txt` returns the expected headers and body.
 
 ## Troubleshooting
 - Pods stuck `Pending` → cluster lacks resources; give minikube/kind more CPU/memory.
diff --git a/docs/work/001-security-txt/1-research.md b/docs/work/001-security-txt/1-research.md
new file mode 100644
index 00000000000..92f39a1b10c
--- /dev/null
+++ b/docs/work/001-security-txt/1-research.md
@@ -0,0 +1,159 @@
+# 001 — security.txt — Research
+
+**Unit:** Add a `GET /.well-known/security.txt` endpoint compliant with RFC 9116 to the Online
+Boutique app, and determine which fields are required vs merely recommended.
+
+## 1. Scope
+
+**In scope**
+- Serve a static/generated `security.txt` document over HTTP from the `frontend` Go service at the
+  well-known path `/.well-known/security.txt` (RFC 8615 + RFC 9116).
+- Emit the two RFC-required fields (`Contact`, `Expires`) plus a small, sensible set of RECOMMENDED
+  fields appropriate for a public demo app.
+- Set the correct `Content-Type: text/plain; charset=utf-8` response header.
+- A few frontend tests pinning the endpoint's path, status, content type, and required-field
+  presence.
+- Answer the user's question: **which RFC 9116 fields are REQUIRED vs merely RECOMMENDED**
+  (section 4 below).
+
+**NOT in scope**
+- **Digital signing** of the file. RFC 9116 §2.3 only RECOMMENDS an OpenPGP cleartext signature; a
+  demo app has no signing key and no security-team key infrastructure. We serve plaintext.
+- **Real security-team infrastructure** — no real inbox, PGP key, disclosure workflow, or
+  vulnerability-handling process is created. `Contact`/`Policy` values point at existing repo
+  resources (placeholder decision deferred to the checkpoint — see §5).
+- **Changing the repo's root-vs-`baseUrl` routing convention** for other routes. The only open
+  routing question is where *this one* endpoint is registered (see §2, §5c).
+- Other services — this is a web/HTTP concern; `frontend` is the sole user-facing HTTP service.
+- New dependencies, config, or build-tooling changes.
+
+## 2. System slice — exact files & seams
+
+- **`src/frontend/main.go`** — router setup (`gorilla/mux`, `mux.NewRouter()` at line 149). Routes
+  are registered with a `baseUrl` prefix. The closest existing analogues are the inline literal-body
+  handlers:
+  - line 160: `r.HandleFunc(baseUrl+"/robots.txt", func(w, _){ fmt.Fprint(w, "...") })`
+  - line 161: `r.HandleFunc(baseUrl+"/_healthz", func(w, _){ fmt.Fprint(w, "ok") })`
+
+  The new route follows the same shape: `r.HandleFunc(<path>+"/.well-known/security.txt", <handler>)`.
+- **`baseUrl`** (`main.go` line 58 `baseUrl = ""`; line 111 `baseUrl = os.Getenv("BASE_URL")`) —
+  a global path prefix, empty by default and overridable via the `BASE_URL` env var. All app routes
+  are registered as `baseUrl + "/..."`. **This is the routing open question** (see §5c): RFC 9116 §3
+  requires the file at the site *root* `/.well-known/security.txt`; registering it as
+  `baseUrl+"/.well-known/security.txt"` means that when `BASE_URL` is non-empty the file no longer
+  sits at the domain root and is technically non-conformant. Flag for the checkpoint whether to
+  register at the **literal root path** (`/.well-known/security.txt`, ignoring `baseUrl`) or **under
+  `baseUrl`** for consistency with every other route. Note: with the default empty `baseUrl` both
+  are identical, so this only matters for `BASE_URL`-prefixed deployments.
+- **Optional small handler / helper** — the body can be an inline closure like `robots.txt`, or a
+  tiny named handler/helper if we generate the `Expires` timestamp dynamically (recommended, §3).
+  A helper that builds the document body is the DRY choice and is trivially unit-testable.
+- **`src/frontend/handlers.go`** — handler + logging conventions (logrus `FieldLogger` pulled from
+  request context via `r.Context().Value(ctxKeyLog{})`, `renderHTTPError` for failures). A static
+  200 response needs no error path, so a `robots.txt`-style inline handler is a fair match; adopt the
+  logging pattern only if a named handler is introduced.
+- **Frontend tests** — there are currently **no `*_test.go` files under `src/frontend/`**, so this
+  unit introduces the first frontend test file. Tests exercise the mux router / handler with
+  `net/http/httptest` (no gRPC backends touched).
+- **No outbound seam** — the response is pure static/generated text. No gRPC call, no backend
+  dependency, nothing to mock.
+
+## 3. Stack & seams
+
+- **Language / libs:** Go, `github.com/gorilla/mux`, stdlib `net/http`. No new dependency.
+- **Response construction:** set `w.Header().Set("Content-Type", "text/plain; charset=utf-8")`
+  explicitly (RFC 9116 §3/§4 — MUST), then write the body. `fmt.Fprint` (as `robots.txt` does) does
+  not set an RFC-conformant content type on its own, so the header must be set deliberately.
+- **Dynamic `Expires`:** RFC 9116 §2.5.5 requires exactly one `Expires` and RECOMMENDS it be less
+  than one year in the future. A hard-coded literal timestamp goes stale and eventually becomes
+  invalid (expired). **Recommend generating `Expires` dynamically** at request time (or process
+  start) as `now + N` (e.g. `time.Now().UTC().AddDate(1, 0, 0)` minus a margin, or ~6 months)
+  formatted as RFC 3339 (`time.RFC3339`), so the file never expires. This is the main reason to
+  prefer a small helper/handler over a pure literal string.
+- **Line endings / encoding:** UTF-8 (§4); CRLF or LF both valid (§2.2) — plain `\n` is fine.
+- **Testing seam:** `httptest.NewRecorder()` + the configured `*mux.Router` (or the handler
+  directly) — assert status 200, `Content-Type`, and presence/shape of `Contact` and `Expires`.
+
+## 4. RFC 9116 — required vs recommended fields
+
+This section directly answers the user's question ("ustal, które pola są wymagane, a które tylko
+zalecane").
+
+### REQUIRED (MUST) — only two fields
+
+| Field | RFC ref | Rule | Value format |
+| :---- | :------ | :--- | :----------- |
+| **Contact** | §2.5.3 | MUST always be present. One or more allowed; may repeat, with the **first = most preferred**. | A URI: `mailto:`, `tel:`, or `https://`. Web URIs **MUST** be `https://`. |
+| **Expires** | §2.5.5 | MUST always be present; **MUST NOT** appear more than once (exactly one). | RFC 3339 timestamp; RECOMMENDED to be **< 1 year** in the future. |
+
+**Minimal valid file = `Contact` + `Expires` only.**
+
+### RECOMMENDED / OPTIONAL — all optional per §2.5
+
+| Field | RFC ref | Notes |
+| :---- | :------ | :---- |
+| Encryption | §2.5.4 | RECOMMENDED when `Contact` is an email address (points to a key). Value is a URI; MUST NOT point to a private key. |
+| Acknowledgments | §2.5.1 | Link to a page recognizing reporters. |
+| Preferred-Languages | §2.5.8 | Comma-separated language tags (RFC 5646). **MUST NOT** appear more than once. |
+| Canonical | §2.5.2 | Canonical URI(s) of this file. RECOMMENDED when the file is signed. |
+| Policy | §2.5.7 | Link to the vulnerability disclosure policy. Orgs SHOULD use it. |
+| Hiring | §2.5.6 | Link to security-related job postings. |
+
+### Format rules that shape the HTTP response
+
+- **Path:** `/.well-known/security.txt` (RFC 8615), served over **https**, applies only to the exact
+  domain it is served from (§3, §3.1).
+- **Syntax:** `Field: value`, one field per line; field names are **case-insensitive** (§2).
+  Comment lines start with `#` (§2.1).
+- **Line endings:** CRLF or LF both valid (§2.2).
+- **Encoding:** UTF-8 (§4).
+- **Content-Type:** MUST be `text/plain; charset=utf-8` (§3/§4).
+- **Signature:** OpenPGP cleartext signature is RECOMMENDED, not required (§2.3); `Canonical` is
+  RECOMMENDED when the file is signed.
+
+### Not an RFC 9116 field
+
+- **CSAF** is **not** defined in RFC 9116. It is a later addition to the IANA
+  "security.txt Fields" registry (an extension). Treat as an extension only; do not include it as a
+  core requirement.
+
+## 5. Unknowns / open questions (for the checkpoint)
+
+- **(a) `Contact` value for a demo app.** There is no real security team or inbox. Options:
+  a GitHub Security Advisories URL for the repo
+  (`https://github.com/<org>/microservices-demo/security/advisories`), the repo Issues URL, or a
+  placeholder `mailto:`. **Recommendation:** use an `https://` GitHub security-advisories / repo URL
+  (avoids a fake mailbox and keeps the web-URI-must-be-https rule satisfied). Confirm the exact
+  org/repo path at the checkpoint.
+- **(b) Which RECOMMENDED fields to include.** **Suggested minimal-but-useful set:** `Contact`,
+  `Expires` (required) + `Preferred-Languages: en` + `Policy` (and/or `Acknowledgments`) pointing at
+  a repo resource. Skip `Encryption` (no PGP key), `Canonical` (only meaningful when signed),
+  `Hiring`. Confirm the set and the target URLs at the checkpoint.
+- **(c) Root path vs `baseUrl` prefix.** Register at the literal root `/.well-known/security.txt`
+  (strict RFC conformance regardless of `BASE_URL`) or under `baseUrl` like every other route
+  (repo consistency)? Both are identical with the default empty `baseUrl`. **Recommendation:** lean
+  toward the literal root path for RFC conformance, but decide at the checkpoint.
+- **(d) Static literal vs dynamically-generated `Expires`.** **Recommendation: dynamic** (§3) so the
+  file never goes stale/expired. Confirm the rolling window (e.g. 6 months vs ~1 year) at the
+  checkpoint.
+
+## 6. Findings & sources
+
+- **RFC 9116** — "A File Format to Aid in Security Vulnerability Disclosure."
+  <https://www.rfc-editor.org/rfc/rfc9116.txt> · <https://datatracker.ietf.org/doc/html/rfc9116>
+  - §2 syntax / case-insensitive field names; §2.1 comments; §2.2 line endings (CRLF or LF);
+    §2.3 signing (RECOMMENDED, not required).
+  - §2.5 all fields optional except as noted; §2.5.1 Acknowledgments; §2.5.2 Canonical;
+    §2.5.3 **Contact (REQUIRED)**; §2.5.4 Encryption; §2.5.5 **Expires (REQUIRED, exactly one)**;
+    §2.5.6 Hiring; §2.5.7 Policy; §2.5.8 Preferred-Languages (at most once).
+  - §3 / §3.1 location `/.well-known/security.txt`, https, per-domain; MUST content type; §4 UTF-8.
+- **securitytxt.org** — human-readable summary + generator. <https://securitytxt.org/>
+- **IANA "security.txt Fields" registry** (source of truth for field names / extensions incl. CSAF).
+  <https://www.iana.org/assignments/security-txt-fields/>
+- **RFC 8615** — Well-Known URIs (the `/.well-known/` path convention).
+- **Local code (verified by reading):** `src/frontend/main.go` lines 58, 111 (`baseUrl` default `""`
+  / `BASE_URL`), 149-163 (router + `robots.txt`/`_healthz` inline handlers); `src/frontend/handlers.go`
+  (logrus-from-context + `renderHTTPError` conventions); no `src/frontend/*_test.go` exists yet.
+  Build/test per CLAUDE.md: `cd src/frontend && go build ./... && go test ./...`.
+
+Task tier: lightweight — single Go service, 1-2 files, no new dependency, no outbound seam, pinnable with a handful of httptest-based tests, no config/build-tooling change.
diff --git a/docs/work/001-security-txt/2-tests.md b/docs/work/001-security-txt/2-tests.md
new file mode 100644
index 00000000000..3a211ffaec0
--- /dev/null
+++ b/docs/work/001-security-txt/2-tests.md
@@ -0,0 +1,152 @@
+# 001 — security.txt — Behaviour spec (tests)
+
+**Unit:** `GET /.well-known/security.txt` on the `frontend` Go service, RFC 9116 compliant.
+
+Locked decisions this spec pins (from the research checkpoint — not re-opened here):
+- Fields: REQUIRED ONLY — exactly `Contact` and `Expires`, nothing else.
+- `Contact` value: placeholder `mailto:security@example.com`.
+- Route registered at the **literal root** `/.well-known/security.txt` (not under `baseUrl`).
+- `Expires` generated **dynamically** at request time as a rolling ~6 months in the future,
+  formatted `time.RFC3339`; always in the future and less than 1 year out.
+
+## 1. In scope / Out of scope
+
+**In scope to test**
+- HTTP status code of the response.
+- `Content-Type` response header value.
+- Presence and exact value of the `Contact` field line.
+- Presence, uniqueness, and validity (RFC 3339, in-the-future, <1 year out) of the `Expires` field
+  line.
+- That no field lines other than `Contact` and `Expires` appear in the body (pins the
+  "required-only" decision).
+- That the route is reachable at the literal path `/.well-known/security.txt`, independent of the
+  `baseUrl`/`BASE_URL` mechanism used by other routes.
+- Allowed HTTP method(s) for the route (`GET`, mirroring the other routes' `.Methods(...)`
+  declarations).
+
+**Out of scope to test**
+- Digital signing (OpenPGP cleartext signature) — not implemented, per research §"NOT in scope".
+- Real security-team infrastructure (a real inbox, PGP key, disclosure workflow) — the `Contact`
+  value is an acknowledged placeholder, not a live channel.
+- TLS/HTTPS enforcement — a deployment/ingress concern, not something the Go handler controls.
+- The `baseUrl` prefix behaviour of *other* routes (`/`, `/cart`, `/product/{id}`, etc.) — untouched
+  by this unit.
+- Any RECOMMENDED RFC 9116 field (`Policy`, `Preferred-Languages`, `Encryption`,
+  `Acknowledgments`, `Canonical`, `Hiring`) — explicitly excluded by the "required only" decision.
+- gRPC backends / `frontendServer` dependencies — this handler has no outbound seam.
+
+## 2. Seams
+
+- **Router/handler seam only.** The test drives the registered route through
+  `net/http/httptest`: build an `httptest.NewRecorder()` + an `http.Request` (via
+  `httptest.NewRequest`), dispatch it through the `*mux.Router` that owns the
+  `/.well-known/security.txt` registration, and assert on the recorded response
+  (`recorder.Code`, `recorder.Header()`, `recorder.Body.String()`).
+- **No gRPC backends, no mocks.** The handler is pure — no call to `frontendServer` fields or any
+  backend service — so the test needs no fakes/mocks and does not need to construct a
+  `frontendServer{}` at all if the handler is a free function/closure (consistent with the
+  `robots.txt`/`_healthz` pattern at `main.go` lines 160-161).
+- **How the test obtains a router:** this repo currently has **no `*_test.go` files** under
+  `src/frontend/`, so this unit introduces the first one (e.g. `src/frontend/main_test.go`).
+  The test needs a `*mux.Router` (or the bare handler) that has the security.txt route registered.
+  Two viable options, left to the test author/coder to pick at implementation time:
+  1. A small test-only helper that builds a minimal `mux.Router` and registers just this one
+     route (fast, fully isolated, but registers the route a second time outside `main()` — a
+     minor duplication risk flagged as an open question below).
+  2. Exercising the real route registration path from `main.go` (e.g. by extracting the
+     `r.HandleFunc(".../.well-known/security.txt", ...)` line into a small exported/testable
+     registration function called from both `main()` and the test), which avoids duplication
+     but is an implementation-shape decision for the plan step, not this spec.
+  Either way, the *observable behaviour* under test is identical: a GET to
+  `/.well-known/security.txt` on the assembled router returns the RFC 9116-conformant response.
+
+## 3. Scenarios
+
+### T-001 — Happy path: 200 OK
+- **Tag:** happy-path
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** the response status code is `200`
+
+### T-002 — Content-Type is exactly `text/plain; charset=utf-8`
+- **Tag:** happy-path
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** the response `Content-Type` header equals exactly `text/plain; charset=utf-8`
+  (not merely containing "text/plain" — the full RFC 9116 §3/§4-mandated value)
+
+### T-003 — Contact field present with the correct placeholder value
+- **Tag:** happy-path
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** the response body contains a line exactly equal to
+  `Contact: mailto:security@example.com`
+
+### T-004 — Expires field present exactly once, RFC 3339-valid, and in the future
+- **Tag:** happy-path
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** the response body contains **exactly one** line starting with `Expires:`;
+  **and** the value after `Expires: ` parses successfully with `time.Parse(time.RFC3339, value)`;
+  **and** the parsed time is after `time.Now()` (in the future);
+  **and** the parsed time is less than `time.Now().AddDate(1, 0, 0)` (under ~1 year out — RFC 9116
+  §2.5.5 RECOMMENDED bound)
+
+### T-005 — Only required fields appear (no RECOMMENDED/extension fields)
+- **Tag:** edge-negative
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** every non-comment, non-blank line in the body matches the field-line pattern
+  `^(Contact|Expires): `; **and** no line begins with any other known RFC 9116 field name
+  (`Policy:`, `Preferred-Languages:`, `Encryption:`, `Acknowledgments:`, `Canonical:`, `Hiring:`),
+  pinning that the "required-only" decision holds
+
+### T-006 — Route resolves at the literal root, independent of `BASE_URL`
+- **Tag:** edge-negative
+- **Given** the frontend router is constructed with a non-empty `baseUrl` (e.g. simulating
+  `BASE_URL=/shop` the way `main.go` line 111 would set it), while the security.txt route itself
+  is registered at the literal `/.well-known/security.txt` (per the locked routing decision)
+- **When** the test sends `GET /.well-known/security.txt` (the literal path, with no `baseUrl`
+  prefix)
+- **Then** the response status is `200` (the route resolves at the domain root regardless of
+  `baseUrl`)
+- **Seam note:** expressing "independent of `BASE_URL`" as an observable behaviour depends on how
+  the test constructs the router (see §2's two options). If the test only ever builds a router
+  with the route registered directly at the literal path, this scenario reduces to "the route is
+  registered outside/independent of any `baseUrl`+prefix call" — verified by inspecting that the
+  registration under test does not concatenate `baseUrl`, rather than by varying an actual
+  `BASE_URL` env var end-to-end. Treat as a seam limitation, not a scenario to weaken.
+
+### T-007 — GET is accepted
+- **Tag:** happy-path
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `GET /.well-known/security.txt`
+- **Then** the response status is `200` (restates T-001's method explicitly, to pin GET as the
+  supported method before any method-restriction is added)
+
+### T-008 — POST to the route (negative, open question — see §4)
+- **Tag:** edge-negative
+- **Given** the frontend router has the `/.well-known/security.txt` route registered
+- **When** the test sends `POST /.well-known/security.txt`
+- **Then** *(open — depends on whether `.Methods(http.MethodGet, http.MethodHead)` is added, as
+  the other routes do at `main.go` lines 150-158)*:
+  - if the route declares `.Methods(...)` restricting to GET/HEAD: expect `405 Method Not Allowed`
+  - if the route is registered without `.Methods(...)` (like `robots.txt`/`_healthz` today, which
+    accept any method): expect `200` (gorilla/mux's default `HandleFunc` matches all methods)
+  This scenario is written to be resolved at plan time per the decision in §4; whichever behaviour
+  is chosen, the test MUST assert that exact status, not skip the case.
+
+## 4. Open questions
+
+- **Method restriction (GET only vs GET+HEAD vs unrestricted):** `main.go`'s existing routes are
+  inconsistent — most declare `.Methods(http.MethodGet, http.MethodHead)` (e.g. `/`, `/product/{id}`,
+  `/cart`), but the two closest analogues (`robots.txt`, `_healthz`, lines 160-161) declare **no**
+  `.Methods(...)` at all, so gorilla/mux accepts any method there. The research did not lock this
+  down. **Recommendation carried into T-007/T-008:** match the `robots.txt`/`_healthz` precedent
+  (no explicit `.Methods(...)`) unless the plan step decides HEAD support is worth adding for a
+  static text resource — either choice is a one-line change and T-008 is written to assert
+  whichever is chosen, not to leave it untested.
+- **Router-construction seam (T-006):** whether the coder introduces a small extracted
+  registration helper (testable against a synthetic router) or the test builds a minimal
+  purpose-built router replicating just this one `HandleFunc` call. Left to the plan/implementation
+  step; both satisfy every scenario above identically.
diff --git a/docs/work/001-security-txt/3-plan.md b/docs/work/001-security-txt/3-plan.md
new file mode 100644
index 00000000000..c1bc577de34
--- /dev/null
+++ b/docs/work/001-security-txt/3-plan.md
@@ -0,0 +1,146 @@
+# Plan: 001-security-txt
+
+**Inputs:** [1-research.md](./1-research.md), [2-tests.md](./2-tests.md)
+
+**Summary:** Add a `GET /.well-known/security.txt` endpoint to the `frontend` Go service, RFC 9116
+compliant with the required-only body (`Contact` + dynamically-generated `Expires`), registered at
+the literal root path so it stays conformant regardless of `BASE_URL`. Backed by the first
+`src/frontend/*_test.go` file, covering T-001..T-008.
+
+**Commit convention:** every task below is one atomic commit on branch `work/001-security-txt`
+per [docs/commit-conventions.md](../../commit-conventions.md); the unit ends with a squash PR to
+`main`, team-reviewed and merged manually.
+
+## Locked decisions (from research/tests checkpoints — not re-opened)
+- Body: REQUIRED fields only — exactly `Contact` and `Expires`.
+- `Contact: mailto:security@example.com`.
+- Path: literal root `/.well-known/security.txt`, registered independent of `baseUrl`/`BASE_URL`.
+- `Expires`: generated at request time, `time.Now().UTC().AddDate(0, 6, 0)`, formatted
+  `time.RFC3339`.
+- Method: unrestricted — `r.HandleFunc(...)` with no `.Methods(...)`, matching the
+  `robots.txt`/`_healthz` precedent (T-008 expects `200` on POST).
+
+## Phases
+
+### P3-01: Baseline green
+- id: P3-01
+- phase: baseline
+- batch: B0
+- mode: serial (orchestrator only, no subagent)
+- files touched: none
+- acceptance criterion: `cd src/frontend && go build ./... && go test ./...` passes before any
+  change
+- maps-to test IDs: n/a
+- expected-red: no
+- high-risk: no
+
+### P3-02: Seam — securityTxtHandler stub + route registration
+- id: P3-02
+- phase: seams
+- batch: B1
+- mode: serial
+- files touched: `src/frontend/main.go`
+- acceptance criterion: TRUE scaffolding only, no behaviour. A named handler
+  `securityTxtHandler(w http.ResponseWriter, _ *http.Request)` exists as a STUB — it writes only a
+  placeholder/empty body and does **not** set the final `Content-Type: text/plain; charset=utf-8`,
+  does **not** write the `Contact` line, and does **not** write the `Expires` line (no
+  body-builder helper with real content is introduced here); it is registered via
+  `r.HandleFunc("/.well-known/security.txt", securityTxtHandler)` in `main()` at the literal root
+  path (NOT `baseUrl+...`), alongside the `robots.txt`/`_healthz` lines. Acceptance: `go build
+  ./...` stays green and the route is reachable (returns a response at all) — no real
+  security.txt behaviour ships in this task
+- maps-to test IDs: n/a
+- expected-red: no
+- high-risk: no
+
+### P3-03: Red tests — all 8 scenarios
+- id: P3-03
+- phase: red-tests
+- batch: B2
+- mode: serial
+- files touched: `src/frontend/security_txt_test.go` (new)
+- acceptance criterion: one test file with 8 sub-tests/cases (T-001..T-008), each named after its
+  test ID, driving the router via `httptest`; the suite compiles and is committed in a genuinely
+  red state: against P3-02's stub, T-002 (exact `Content-Type`), T-003 (`Contact` line), T-004
+  (`Expires` line), and T-005 (required-only fields) fail, because the stub sets no
+  `Content-Type` and writes none of the required field lines. The suite is expected-red plainly
+  because the handler under test is still a stub, not the real body-builder — not because the
+  tests are weak or trivial
+- maps-to test IDs: T-001, T-002, T-003, T-004, T-005, T-006, T-007, T-008
+- expected-red: yes
+- high-risk: no
+
+### P3-04: Implementation — RFC-conformant body + headers
+- id: P3-04
+- phase: implementation
+- batch: B3
+- mode: serial
+- files touched: `src/frontend/main.go`
+- acceptance criterion: replace the P3-02 stub's body with the real implementation:
+  `securityTxtHandler` (backed by a body-builder helper) sets `Content-Type: text/plain;
+  charset=utf-8`, writes exactly two field lines (`Contact: mailto:security@example.com` and a
+  dynamically generated `Expires: <RFC3339 timestamp>` via `time.Now().UTC().AddDate(0, 6, 0)`
+  formatted with `time.RFC3339`), no other field lines, method unrestricted (no `.Methods(...)`).
+  This is the task that turns P3-03's red suite green: T-001..T-008 pass with `go test ./...`
+  green
+- maps-to test IDs: T-001, T-002, T-003, T-004, T-005, T-006, T-007, T-008
+- expected-red: no
+- high-risk: no
+
+### P3-05: Consolidation — DRY + final green
+- id: P3-05
+- phase: consolidation
+- batch: B4
+- mode: serial
+- files touched: `src/frontend/main.go`, `src/frontend/security_txt_test.go` (edge cleanup only,
+  no new scenarios)
+- acceptance criterion: body construction extracted to a small helper if not already (e.g.
+  `securityTxtBody() string`) for readability/DRY; `gofmt`/`go vet` clean;
+  `cd src/frontend && go build ./... && go test ./...` green as the final state of the feature
+- maps-to test IDs: n/a
+- expected-red: no
+- high-risk: no
+
+### P3-06: E2E live smoke
+- id: P3-06
+- phase: e2e
+- batch: B5
+- mode: serial (dispatched to `e2e-tester`, not `coder`)
+- files touched: `docs/test/001-security-txt/` (new evidence + `summary.md`)
+- acceptance criterion: this unit ships a user-observable new endpoint, so the e2e task is
+  REQUIRED — there is no n/a fallback. Per `docs/test/README.md`'s `frontend` subsection bring-up
+  (`skaffold run` + `kubectl port-forward deployment/frontend 8080:8080`), `curl -i
+  http://localhost:8080/.well-known/security.txt` returns `200`, `Content-Type: text/plain;
+  charset=utf-8`, and a body containing `Contact: mailto:security@example.com` and an `Expires:`
+  line; PASS `summary.md` + ordered evidence committed to `docs/test/001-security-txt/`. If the
+  live cluster proves infeasible in the execution environment, that is handled by the orchestrator
+  at execute time as an explicit, justified exception — it is not pre-authorized here and is not a
+  substitute for attempting the real smoke
+- maps-to test IDs: n/a
+- expected-red: no
+- high-risk: no
+
+## TODO (work-execute consumes this)
+
+### Batch B0 — baseline (orchestrator only, no dispatch)
+- [x] P3-01 (baseline) verify `go build ./...` + `go test ./...` green in `src/frontend`
+
+### Batch B1 — seams (1 coder dispatch, serial)
+- [x] P3-02 (seams) add `securityTxtHandler` STUB (placeholder body, no real Content-Type/Contact/
+      Expires), register `/.well-known/security.txt` at literal root
+
+### Batch B2 — red tests (1 coder dispatch, serial) [expected-red]
+- [x] P3-03 (red-tests) all 8 scenarios in `security_txt_test.go`, genuinely red against the P3-02
+      stub -> maps T-001, T-002, T-003, T-004, T-005, T-006, T-007, T-008
+
+### Batch B3 — implementation (1 coder dispatch, serial)
+- [x] P3-04 (implementation) replace stub with RFC-conformant body (Contact + dynamic Expires) +
+      headers, required-only, literal-root, method-unrestricted, T-001..T-008 red -> green -> maps
+      T-001, T-002, T-003, T-004, T-005, T-006, T-007, T-008
+
+### Batch B4 — consolidation (1 coder dispatch, serial)
+- [x] P3-05 (consolidation) DRY body-builder helper, final `go build`/`go test` green
+
+### Batch B5 — e2e live smoke (1 e2e-tester dispatch) [REQUIRED — no n/a fallback]
+- [x] P3-06 (e2e) live smoke per docs/test/README.md -> PASS summary.md + evidence in
+      docs/test/001-security-txt/
diff --git a/src/frontend/main.go b/src/frontend/main.go
index 754b653e51a..98f63664b26 100644
--- a/src/frontend/main.go
+++ b/src/frontend/main.go
@@ -158,6 +158,7 @@ func main() {
 	r.HandleFunc(baseUrl+"/assistant", svc.assistantHandler).Methods(http.MethodGet)
 	r.PathPrefix(baseUrl + "/static/").Handler(http.StripPrefix(baseUrl+"/static/", http.FileServer(http.Dir("./static/"))))
 	r.HandleFunc(baseUrl+"/robots.txt", func(w http.ResponseWriter, _ *http.Request) { fmt.Fprint(w, "User-agent: *\nDisallow: /") })
+	r.HandleFunc("/.well-known/security.txt", securityTxtHandler)
 	r.HandleFunc(baseUrl+"/_healthz", func(w http.ResponseWriter, _ *http.Request) { fmt.Fprint(w, "ok") })
 	r.HandleFunc(baseUrl+"/product-meta/{ids}", svc.getProductByID).Methods(http.MethodGet)
 	r.HandleFunc(baseUrl+"/bot", svc.chatBotHandler).Methods(http.MethodPost)
@@ -170,6 +171,19 @@ func main() {
 	log.Infof("starting server on %s:%s", addr, srvPort)
 	log.Fatal(http.ListenAndServe(addr+":"+srvPort, handler))
 }
+
+// securityTxtBody returns the RFC 9116 security.txt content with a rolling
+// Expires timestamp (~6 months out, RFC 3339).
+func securityTxtBody() string {
+	expires := time.Now().UTC().AddDate(0, 6, 0).Format(time.RFC3339)
+	return fmt.Sprintf("Contact: mailto:security@example.com\nExpires: %s\n", expires)
+}
+
+func securityTxtHandler(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	fmt.Fprint(w, securityTxtBody())
+}
+
 func initStats(log logrus.FieldLogger) {
 	// TODO(arbrown) Implement OpenTelemtry stats
 }
diff --git a/src/frontend/security_txt_test.go b/src/frontend/security_txt_test.go
new file mode 100644
index 00000000000..36f2fb521c4
--- /dev/null
+++ b/src/frontend/security_txt_test.go
@@ -0,0 +1,191 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+)
+
+const securityTxtPath = "/.well-known/security.txt"
+
+// newSecurityTxtRouter builds a minimal router with only the security.txt
+// route registered, driving requests straight to the real securityTxtHandler
+// from main.go.
+func newSecurityTxtRouter() *mux.Router {
+	r := mux.NewRouter()
+	r.HandleFunc(securityTxtPath, securityTxtHandler)
+	return r
+}
+
+// newSecurityTxtRouterWithBaseURL builds a router that also registers other
+// routes under a non-empty baseUrl prefix, to pin that security.txt is
+// reachable at the literal root regardless of that prefix (T-006).
+func newSecurityTxtRouterWithBaseURL(baseUrl string) *mux.Router {
+	r := mux.NewRouter()
+	r.HandleFunc(baseUrl+"/shop/", func(w http.ResponseWriter, _ *http.Request) {})
+	r.HandleFunc(securityTxtPath, securityTxtHandler)
+	return r
+}
+
+func TestT001_HappyPath_200OK(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", rec.Code)
+	}
+}
+
+func TestT002_ContentTypeIsExactlyTextPlainCharsetUTF8(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	got := rec.Header().Get("Content-Type")
+	want := "text/plain; charset=utf-8"
+	if got != want {
+		t.Fatalf("expected Content-Type %q, got %q", want, got)
+	}
+}
+
+func TestT003_ContactFieldPresentWithPlaceholderValue(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	want := "Contact: mailto:security@example.com"
+	body := rec.Body.String()
+	found := false
+	for _, line := range strings.Split(body, "\n") {
+		if line == want {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("expected a line exactly equal to %q in body:\n%s", want, body)
+	}
+}
+
+func TestT004_ExpiresFieldPresentOnceValidAndInFuture(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	body := rec.Body.String()
+	var expiresLines []string
+	for _, line := range strings.Split(body, "\n") {
+		if strings.HasPrefix(line, "Expires:") {
+			expiresLines = append(expiresLines, line)
+		}
+	}
+	if len(expiresLines) != 1 {
+		t.Fatalf("expected exactly one Expires: line, got %d: %v", len(expiresLines), expiresLines)
+	}
+
+	value := strings.TrimPrefix(expiresLines[0], "Expires: ")
+	parsed, err := time.Parse(time.RFC3339, value)
+	if err != nil {
+		t.Fatalf("expected Expires value to parse as RFC3339, got %q: %v", value, err)
+	}
+
+	now := time.Now()
+	if !parsed.After(now) {
+		t.Fatalf("expected Expires %v to be after now %v", parsed, now)
+	}
+	if !parsed.Before(now.AddDate(1, 0, 0)) {
+		t.Fatalf("expected Expires %v to be before one year from now %v", parsed, now.AddDate(1, 0, 0))
+	}
+}
+
+func TestT005_OnlyRequiredFieldsAppear(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	body := rec.Body.String()
+	fieldLine := regexp.MustCompile(`^(Contact|Expires): `)
+	disallowedPrefixes := []string{
+		"Policy:", "Preferred-Languages:", "Encryption:", "Acknowledgments:", "Canonical:", "Hiring:",
+	}
+
+	for _, line := range strings.Split(body, "\n") {
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		if !fieldLine.MatchString(line) {
+			t.Fatalf("expected line to match ^(Contact|Expires): , got %q", line)
+		}
+		for _, prefix := range disallowedPrefixes {
+			if strings.HasPrefix(line, prefix) {
+				t.Fatalf("expected no line to begin with %q, but found %q", prefix, line)
+			}
+		}
+	}
+}
+
+func TestT006_RouteResolvesAtLiteralRootIndependentOfBaseURL(t *testing.T) {
+	router := newSecurityTxtRouterWithBaseURL("/shop")
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200 for literal path regardless of baseUrl, got %d", rec.Code)
+	}
+}
+
+func TestT007_GETIsAccepted(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodGet, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200 for GET, got %d", rec.Code)
+	}
+}
+
+func TestT008_POSTIsUnrestricted(t *testing.T) {
+	router := newSecurityTxtRouter()
+	req := httptest.NewRequest(http.MethodPost, securityTxtPath, nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200 for POST (method unrestricted), got %d", rec.Code)
+	}
+}
