What Is security.txt? Responsible Disclosure for Your Domain
security.txt is a well-known file that tells researchers how to report vulnerabilities on your domain. Learn the RFC 9116 fields, where to host it, and what to include.
security.txt is a text file, defined in RFC 9116, that tells security researchers how to contact you about vulnerabilities. It lives at a predictable path so scanners and humans do not have to dig through a marketing site to find a disclosure email.
Publishing security.txt does not mean your site is insecure. It means you accept reports through a channel you control. Pair it with solid HTTP security headers and regular scans so fewer reports are preventable misconfigurations.
Where to publish security.txt
- Preferred:
https://yourdomain.com/.well-known/security.txt - Also accepted by many tools:
https://yourdomain.com/security.txt - Serve over HTTPS on the canonical host researchers will actually visit.
Required and useful fields
Contact: mailto:security@example.com Expires: 2027-10-19T00:00:00.000Z Preferred-Languages: en Canonical: https://example.com/.well-known/security.txt Policy: https://example.com/security-policy
- Contact - mailto: or https: URL where reports should go (required).
- Expires - ISO timestamp; refresh before it lapses so the file stays valid.
- Canonical - the authoritative URL of this file.
- Policy - link to your vulnerability disclosure or bug bounty rules.
- Preferred-Languages - languages your security team can handle.
An empty Contact address is worse than no file. Route security@ to people who can acknowledge reports within a few business days.
What security.txt is not
It is not a replacement for CSP, HSTS, or email authentication. It does not stop attackers. It improves the odds that a friendly researcher emails you instead of posting a zero-day on social media. For posture checks, use a security headers check and PatchPings features that grade live configuration.
Operational checklist
- 1Create a monitored security mailbox or form.
- 2Publish security.txt with Contact and Expires.
- 3Calendar a renewal before Expires.
- 4Document a short internal playbook for triage and CVE coordination.
- 5Re-scan the site after major releases so researchers are not reporting the same missing header twice.
security.txt is a small file with outsized goodwill. Publish it, keep Expires current, and back it with a real response process. Researchers will find you faster, and your scan report stays focused on issues you can fix in configuration.
