Security.txt Validator

What is Security.txt?

The security.txt file is a standardized way for organizations to communicate security-related contact information and policies to security researchers and the public. It serves as a “how to report vulnerabilities” guide, published at a known location (/.well-known/security.txt) on your website.

By providing clear instructions, the file helps facilitate responsible disclosure and builds trust with users and researchers.

Why is Security.txt Important?

• Facilitates Vulnerability Disclosure: A standardized security.txt file ensures security researchers can easily report vulnerabilities.
• Demonstrates Commitment to Security: Shows your organization takes security and transparency seriously.
• Reduces Miscommunication: Researchers no longer need to guess how to contact your security team.

How Does Security.txt Work?

1. File Location: The security.txt file is hosted at https://{yourdomain}/.well-known/security.txt, making it easy for researchers to locate.
2. Content Specification: The file typically includes:
   • Contact Information: Email or other methods to reach your security team.
   • Acknowledgment Policy: Whether researchers will be publicly credited.
   • Encryption Keys: PGP keys for secure communication.
3. Global Adoption: The format is standardized under RFC 9116, enabling consistent usage across organizations worldwide.

Common Security.txt Issues

• Incorrect or Missing File Location: The security.txt file must be hosted in the /.well-known/ directory to be easily discoverable.
• Incomplete or Inaccurate Information: Missing contact details, ambiguous policies, or outdated encryption keys can confuse researchers.
• Non-Compliance with RFC 9116: Errors in formatting, such as invalid fields or missing required entries, can invalidate your file.
• Lack of Accessibility: Failure to serve the file over HTTPS or making it hard to locate reduces its effectiveness.

Best Practices for Security.txt

• Follow RFC Standards: Ensure your security.txt file complies with RFC 9116 for consistent formatting.
• Keep Information Updated: Regularly update contact details, encryption keys, and disclosure policies to ensure accuracy.
• Provide Secure Contact Options: Offer PGP keys or similar methods for encrypted communication.
• Include Clear Policies: Specify acknowledgment, disclosure timelines, and any legal considerations for researchers.
• Host in the Correct Location: Ensure the file is accessible via https://{yourdomain}/.well-known/security.txt.