CYBER.COUNTRYTools
All toolsTOOL 06 / SECURITY CONTACT

Publish a clear reporting path.

A security.txt file gives researchers a standard place to find your vulnerability-reporting contact and policy. Build the format here, then review, publish, and maintain it on your own site.

Processing
Document built in this browser
Boundary
Formats the file — does not publish it

RFC 9116 builder

Runs locally

Publish the file at /.well-known/security.txt on the same HTTPS origin. This tool formats a file; it does not publish or monitor it.

Required location

/.well-known/security.txt

Format preview

Contact: <reporting URI>
Expires: <future date>
Policy: <policy URI>
HOW IT WORKS

Know what the result means.

  1. [01]

    Complete

    Add at least a contact URI and future expiry date. Optional fields can point to policy, keys, acknowledgments, or hiring pages.

  2. [02]

    Review

    Check every destination, replace all examples, and download the plain-text result. The generator does not verify ownership.

  3. [03]

    Publish

    Serve the file over HTTPS at /.well-known/security.txt on the origin it describes, then keep it current.

READ THE LIMITS

A signal is not a verdict.

  • Generating the text does not publish, monitor, sign, or renew the file.
  • Example values must be replaced with working destinations controlled by the site owner.
  • The Expires field must remain in the future, so the published file needs maintenance.
  • A contact file supports disclosure routing; it does not create a vulnerability-handling programme by itself.

Sources and code

RFC 9116 — A File Format to Aid in Security Vulnerability DisclosureIANA security.txt fields registry