What Is security.txt and Why It Matters for Websites

The security.txt file is a standardized mechanism that allows organizations to clearly communicate how security vulnerabilities should be reported for their website or online service. It acts as a single, authoritative source of truth for security researchers, ethical hackers, and automated tools looking to disclose vulnerabilities responsibly.

Purpose of security.txt

The primary goal of security.txt is to simplify and formalize vulnerability disclosure. Instead of researchers guessing who to contact or sending reports to generic inboxes, the file provides explicit instructions on where and how to report security issues.

This reduces missed reports, improves response times, and supports coordinated disclosure.

The Standard Behind It

security.txt is formally defined in RFC 9116, titled “A File Format to Aid in Security Vulnerability Disclosure”.

  • Published: April 2022
  • Authority: Internet Engineering Task Force (IETF)

RFC 9116 specifies:

  • File locations
  • Required and optional fields
  • Syntax and formatting rules

Where the File Lives

The preferred location is:

https://example.com/.well-known/security.txt

An optional fallback location is:

https://example.com/security.txt

Common Fields

A typical security.txt file may include:

Contact: mailto:security@example.com
Encryption: https://example.com/pgp-key.txt
Policy: https://example.com/security-policy
Acknowledgments: https://example.com/hall-of-fame
Expires: 2026-01-01T00:00:00Z
  • Contact – How to report vulnerabilities (email or URL)
  • Encryption – PGP key for secure communication
  • Policy – Vulnerability disclosure policy
  • Acknowledgments – Credit for reporters
  • Expires – Validity period for the file

Who Uses It

  • Security researchers
  • Bug bounty platforms
  • Automated security scanners
  • Compliance and trust assessment tools

Why Organizations Should Use It

  • Demonstrates security maturity
  • Encourages responsible disclosure
  • Reduces legal and communication ambiguity
  • Improves trust with the security community

What It Is Not

security.txt is not a security control. It does not prevent attacks or fix vulnerabilities. Its role is purely communicative—defining how security issues should be reported.

Summary

By implementing security.txt in line with RFC 9116, organizations provide a clear, professional, and standardized path for vulnerability disclosure. It is a low-effort, high-value addition to any modern web security posture.