security.txt

Someone who finds a flaw on your site needs to know who to tell. Without a published contact they guess at an address, post it publicly, or give up. security.txt is a plain text file at a fixed location that answers the question, so reports reach the right person.

The file

Serve it over HTTPS at /.well-known/security.txt:

Contact: mailto:security@example.com
Expires: 2027-12-31T23:59:59Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy

• •Contact — required. An email address, a web form or a phone number. Give at least one.
• •Expires — required. A date after which the file should be treated as stale. Keep it under a year away and renew it.
• •Canonical — the address the file is meant to be served from.
• •Policy — a link to your disclosure policy, if you have one.
• •Encryption — a link to a public key for sending sensitive details.

Common failure modes

• •No file at all, which is the default.
• •An Expires date in the past. The file then tells researchers it is not to be trusted.
• •The file served over plain HTTP, or at /security.txt only, instead of /.well-known/.
• •A Contact address nobody reads.

The file reveals nothing sensitive and takes minutes to publish. It is also read by the people most likely to help you.