security.txt

security.txt (RFC 9116) is a machine-readable file at /.well-known/security.txt that tells security researchers how to reach you when they find a vulnerability. This check's HTTP module validates the file strictly against the RFC – the generator produces a file that passes.

Serve the file at https://<domain>/.well-known/security.txt with Content-Type: text/plain; charset=utf-8. It applies only to the exact host it is fetched from — not to its subdomains and not to its parent domain (RFC 9116 §3.1) — so serve it under every host that should be covered. Listing several Canonical URIs does not extend that scope (§2.5.2); it only lets a file that answers under several hosts be trusted at each of them, because a file whose retrieval URI appears in no Canonical field should not be trusted. A PGP cleartext signature is recommended – and whenever any of your Contact entries is an email address, also publish an Encryption field pointing to your PGP key (RFC 9116 §2.5.3, §2.5.4; an https URL, or a scheme such as openpgp4fpr: or dns:).

Domain

Contact (email, HTTPS URL or tel:)

Comma-separated, most preferred first. Email addresses become mailto: URIs; you can also use an HTTPS URL or a tel: phone number (spaces in the number are removed).

Expires

Emitted as an RFC 3339 timestamp (…T23:59:59Z); should be less than a year away. Default: about 330 days.

Preferred-Languages (optional)

Encryption – PGP key URL (optional)

Policy – disclosure policy URL (optional)

Add Canonical: https://<domain>/.well-known/security.txt

Records are built in your browser; “Load current record” has our server fetch the published security.txt. Record Studio · Verify the result with the domain security check