Web & certificates

What is security.txt? A File Format to Aid in Security Vulnerability Disclosure explained

security.txt is a small text file on your website that tells security researchers where to report vulnerabilities they find.

How security.txt works

The file lives at https://<domain>/.well-known/security.txt and contains simple "Name: value" fields. Contact (a mailto:, https:// or tel: URI) and Expires (an expiry date) are required.

Expires should be at most one year in the future. This makes sure the information is reviewed regularly and reports do not go to an abandoned address.

Optional fields are Policy (link to the disclosure policy), Encryption (PGP key), Preferred-Languages and Canonical (the official URL of the file). The file can also be PGP-signed.

Example

# https://example.com/.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-09-30T00:00:00Z
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt

Put the Expires date in your calendar and update the file before it runs out.

Common mistakes

An expired Expires date – reporters then assume the information is outdated.
The file is only at /security.txt instead of /.well-known/security.txt.
The contact address does not exist or ends up in an unmonitored mailbox.

How the Domain Trust Check rates security.txt

Criterion “security.txt” (weight 1 of 5): The file /.well-known/security.txt (RFC 9116) with a valid Contact field and an Expires date that has not passed and is at most one year ahead.

Standard: RFC 9116