How it works
A security.txt file (RFC 9116) at /.well-known/security.txt tells security researchers how to report a vulnerability to you. Without one, a researcher who found a problem may not find the right person, and the report goes nowhere or ends up public.
Once a day, we fetch the file and check its two required fields:
- Contact: where to send reports, such as
mailto:[email protected]or a URL. - Expires: a date after which the file should no longer be trusted. We warn 30 days before it.
Statuses
| Status | Meaning |
|---|---|
| OK | The file is present and valid, and expires more than 30 days from now. |
| Warning | The file is missing, has no Contact field, has no valid Expires field, has expired or expires soon, or we could not connect. |
By default you are notified of failures only. This check never fails, so it only alerts you if you change its notification level.
Example
Contact: mailto:[email protected]
Expires: 2027-10-01T00:00:00Z
Preferred-Languages: en
Policy: https://example.com/security-policy
Serve it at https://yourdomain/.well-known/security.txt, and set a reminder to renew the Expires date. A year ahead is common.