Tools / security.txt
When someone finds a hole, who do they tell?
A security.txt is a small file at a well-known address that says where to send a vulnerability report. Researchers, scanners and the NCSC look for it; most UK organisations do not have one, and half of those that do have let it expire. Enter a site to check its file against the standard, or write one below.
Contact · Expires · Canonical · Encryption · Policy · Signature · Content-TypeFree · No sign-up · PDF report
What it checks
Is it where researchers look
RFC 9116 puts the file at /.well-known/security.txt over HTTPS. The checker tries that, the legacy top-level path, and the www host, and tells you which answered.
The two required fields
Contact: (mailto:, https:// or tel:) and Expires: (an ISO 8601 date-time, less than a year away). A file without either is invalid; a file past its Expires date is stale.
Can it be trusted
Canonical: should name the URL the file is served from, and a PGP cleartext signature with the key published under Encryption: lets a reader confirm the contact details are really yours.
The optional fields that help
Policy: (what you promise researchers), Encryption: (a key for private reports), Acknowledgments:, Preferred-Languages:, Hiring: and CSAF:, each checked for the right URI scheme.
How it is served
text/plain with charset=utf-8, HTTPS, redirects noted, and lines that are neither fields nor comments called out.
A generator when you need one
Contact address and a date in, compliant file out, with the Apache and nginx lines to serve it and the gpg command to sign it.
Why this matters
Most vulnerabilities in most organisations are found by someone outside them: a researcher, a customer, a supplier, a bored student. What happens next depends almost entirely on whether that person can find a way to tell you that feels safe and likely to be read. When they cannot, the finding goes to a mailing list, a social feed, or nowhere, and you hear about it from a journalist or not at all.
security.txt is the agreed answer. It is a text file, it takes a minute to write, and it is read by people and by tooling. The parts that go wrong are always the same: it expires because nobody diarised the date, the contact is a person who has left, or the file lives at the wrong path. This checker catches all three; the generator avoids them. We run the same check for virtual CISO clients as part of the disclosure process we set up for them.
Also in Tools