What is security.txt?

security.txt is a small text file, defined in RFC 9116, that tells security researchers how to report a vulnerability on your website. It lives at /.well-known/security.txt. Without it, someone who finds a bug has to guess who to email, or gives up.

The file needs two fields. Contact says how to reach you, and Expires is the date after which the file counts as out of date. The RFC recommends an Expires date less than a year away, so someone checks the file at least once a year.

Tool description

Type one contact per line. A plain email address becomes a mailto: link, and a phone number becomes a tel: link with the spaces, dashes, dots and brackets removed. Any other contact should be an https:// link. The expiry date starts one year from today and is written as the last second of that day in UTC. Preferred languages is a comma separated list, en by default.

The optional fields are the encryption key, policy, acknowledgments, hiring and canonical URLs. Empty fields are left out of the file.

Copy the file or download it as security.txt. A note under it lists anything that's wrong: no contact, a contact that isn't an email, phone number or https:// link, an expiry date that's missing, past or more than a year away, or a URL that doesn't start with https://. The encryption key may also be an openpgp4fpr: or dns: value.

RFC 9116 also allows a version signed with OpenPGP. This tool writes the plain file.

Example

Two contacts, an expiry date of 2027-10-21, English and German, and three of the URLs give:

Contact: mailto:security@example.com
Contact: tel:+15550100199
Expires: 2027-10-21T23:59:59.000Z
Encryption: https://example.com/pgp-key.txt
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy

The contacts were typed as security@example.com and +1 (555) 010-0199.

Features

  • Turns plain email addresses and phone numbers into valid contacts
  • Checks the expiry date and links as you type
  • Copy the file or download it as security.txt