What is security.txt?
security.txt is a plain-text file at /.well-known/security.txt that tells security researchers how to report vulnerabilities to your organization.
Why businesses care
Without a published contact, people who discover a problem often stay silent.
Example
Contact: mailto:security@example.com
Expires: 2027-10-01T00:00:00ZHow to check
Visit /.well-known/security.txt on your domain, or run the security.txt checker.
How to fix
Publish the file with a monitored Contact and a future Expires date.
Common mistakes
- Letting Expires lapse
- Pointing Contact at an unmonitored mailbox
Sources
Check it with security.txt Checker
Check whether your site publishes /.well-known/security.txt so researchers can report problems, and get a ready-to-use file.
Open security.txt Checker