security.txt generator

When a security researcher finds a vulnerability on your website, they need to know whom to tell. security.txt, standardised in RFC 9116, is a small text file at a well-known location that answers exactly that. Publishing one makes responsible disclosure easier and reduces the chance that a vulnerability report ends up in a generic support inbox or on social media.

How to use it

1. Enter at least one contact, such as an email address or a URL to a reporting form.
2. Set an expiry date, ideally less than a year in the future.
3. Optionally add an encryption key URL, your disclosure policy, acknowledgements page and preferred languages.
4. Publish the file at https://yourdomain.com/.well-known/security.txt.

Example

Contact: mailto:[email protected]
Contact: https://example.com/security/report
Expires: 2027-10-27T00:00:00.000Z
Encryption: https://example.com/pgp-key.txt
Policy: https://example.com/security-policy
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt

Fields

• Contact (required): mailto, https or tel URI. Can appear more than once, in order of preference.
• Expires (required): ISO 8601 date after which the file should be considered stale.
• Encryption: link to a public key for encrypted reports.
• Policy: your vulnerability disclosure policy, including scope and safe harbour.
• Acknowledgments: page thanking researchers.
• Canonical: the file's own URL.

Tips

• Serve it over HTTPS as text/plain.
• Use a role address such as security@ rather than a personal email.
• Put a reminder in your calendar to renew the Expires date.
• Optionally sign the file with PGP for authenticity.