security.txt: how researchers can reach you
When someone finds a vulnerability in your website, they need to know whom to tell. security.txt answers that in a standard place: a small text file at /.well-known/security.txt listing a contact address and a few optional details. It is defined in RFC 9116, published in 2022, and is used by governments, banks and large tech companies.
Fill in your contact, an expiry date and any optional fields, and this generator writes the file ready to upload.
How to use it
- Enter a Contact: a mailto: address, a https:// form or a tel: number.
- Set Expires to a date within the next year; the standard requires the field.
- Optionally add links to your encryption key and acknowledgements page, and your Preferred-Languages, such as en, de.
- Upload the result to https://your-domain/.well-known/security.txt and add a reminder to renew it before it expires.
Example: a minimal valid file
Contact: mailto:security@example.com Expires: 2027-10-26 Preferred-Languages: en, de
Contact: mailto:security@example.com Expires: 2027-10-26T00:00:00.000Z Preferred-Languages: en, de
The expiry date is written as a full ISO 8601 timestamp, the format RFC 9116 asks for.
Required and optional fields
Contact and Expires are required. Contact can appear several times, listed in order of preference. Expires stops stale files from sending reports to an address nobody reads anymore; the RFC recommends a date less than a year ahead. Encryption points to a public key for encrypted reports, Acknowledgements to a page thanking reporters, Policy to your disclosure policy, and Preferred-Languages lists language codes.
Make the contact work
Use an address that a person checks, routed to whoever can triage security issues, and answer quickly, even if only to confirm receipt. Researchers who get no reply often go public. A published disclosure policy that promises not to take legal action against good-faith research encourages people to report to you instead of selling or posting what they find.
Optional: sign the file
RFC 9116 allows the file to be signed with OpenPGP as a cleartext signature, so readers can confirm it was not tampered with. If you sign it, the signature must be renewed whenever the content changes. The generated file is unsigned plain text.
Questions
Is a bug bounty required?
No. security.txt only says how to contact you. Rewards and scope belong in your policy if you have one.
Can I put the file at /security.txt instead?
The standard location is /.well-known/security.txt. Some sites also serve or redirect /security.txt for older tools.
Is anything sent anywhere?
No. The file is generated in your browser.