security.txt Generator (RFC 9116)
Author compliant /.well-known/security.txt vulnerability disclosure manifests required for ISO 27001, SOC 2 Type II, and enterprise penetration testing audits.
Email addresses must be prefixed with mailto:, phone numbers with tel:, or HTTPS URLs to reporting portals.
# Security Vulnerability Disclosure Policy (RFC 9116) # Location: /.well-known/security.txt Contact: mailto:[email protected] Contact: https://example.com/security/report Expires: 2027-11-06T13:19:19Z Encryption: https://example.com/.well-known/pgp-key.txt Acknowledgments: https://example.com/hall-of-fame Preferred-Languages: en, tr Canonical: https://example.com/.well-known/security.txt Policy: https://example.com/security-policy Hiring: https://example.com/careers/security
Deploying /.well-known/security.txt for Vulnerability Disclosure
Ratified by the IETF in April 2022 under RFC 9116, security.txt standardizes how independent security researchers, CERT teams, and automated scanners locate an organization's security reporting channels.
Mandatory Directives
Under RFC 9116 §2.5, both Contact and Expires are strictly mandatory. Automated compliance scanners mark a security.txt file as invalid if either directive is absent or if the Expires timestamp lies more than 365 days in the future.
OpenPGP Clear-Signing
To prevent MITM tampering, RFC 9116 §2.3 recommends digitally signing the manifest using OpenPGP clear-signing (gpg --clearsign security.txt) alongside a matching Canonical URI declaration.
MIME Type & HTTPS Serving
The file must be hosted at /.well-known/security.txt over TLS (HTTPS) and served with a Content-Type: text/plain; charset=utf-8 response header. Legacy root paths (/security.txt) should 301 redirect to the well-known URI.