Skip to content

How to publish a security.txt

Security1 min readFixes check security-txt

security.txt tells researchers where to report a vulnerability. It is a small text file at /.well-known/security.txt.

Step by step, with screenshots: security.txt: the contact file for security researchers →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • security.txt is presentinfo onlyeffort S

No security.txt file

Why it matters. security.txt (RFC 9116) tells security researchers where to report a problem with your site. Without it, a report may never reach you.

How to fix it.
  1. Publish /.well-known/security.txt with a Contact line and an Expires date less than 1 year away.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.