# How to publish a security.txt

> security.txt tells researchers where to report a vulnerability. It is a small text file at /.well-known/security.txt.

Security · HTML version: https://getreport.app/learn/security-txt

## security.txt file

Passing looks like: security.txt is present.

**Why it matters.** security.txt (RFC 9116) tells security researchers where to report a problem with your site. Without it, a report may never reach you.

**How to fix it.**

1. Publish /.well-known/security.txt with a Contact line and an Expires date less than 1 year away.

Check your own page: https://getreport.app/