security.txt Generator
Create a standard file for security researchers to securely report vulnerabilities.
Security.txt Generator
Define clear security policies and vulnerability reporting channels for your domain (RFC 9116).
Policy Configuration
.well-known/security.txt
What is security.txt?
security.txt is a standard proposed in RFC 9116 that allows websites to define security policies and contact information. It tells ethical hackers and security researchers exactly how and where to report vulnerabilities they discover on your site.
Where should I place this file?
The file must be named exactly security.txt and placed in the .well-known/ directory at the root of your domain.
https://example.com/.well-known/security.txt
Required Directives
- Contact: An email address (with
mailto:prefix) or URL where researchers should send their reports. At least one Contact directive must be present. - Expires: A date and time indicating when the data in the security.txt file is no longer valid. This is highly recommended to ensure contact info doesn't become stale.
Related Guides
Deepen your understanding with our expert articles.