You do not strictly need a PGP key to receive vulnerability reports, but offering one is recommended practice. It lets researchers encrypt sensitive details. If you publish a key, someone must own it, test it and keep it current. A key nobody can decrypt is worse than none.
What the guidance says
The OWASP cheat sheet lists PGP keys under intake, as something to offer for encrypted communication. RFC 9116 gives security.txt an optional Encryption field: a URI where a key can be retrieved. The RFC says keys must not appear inline in the file, and that the Encryption key is not assumed to be the signing key.
When a key is worth it
- You expect reports with live exploit details or customer data.
- Your researchers work in sensitive sectors and expect encryption.
- You run an open source project or a product with many users.
For a small company with a plain web app, a monitored security address and a clear policy may carry most of the value. Plenty of reports contain nothing that would hurt if read in transit.
If you publish one
- Create a key for a role address such as the security mailbox, not for one person.
- Store the private key where at least two people can use it.
- Host the public key on your site and point to it with the Encryption field.
- Test by having someone send you an encrypted message every quarter.
- Set an expiry and a renewal reminder.
- Plan what happens when the key holder leaves.
Options for people who do not use PGP
Offer a second channel. A web form served over HTTPS, a bounty or disclosure platform, or a request for a short first message with details sent after contact is made all work. Say in your policy that researchers can write first without encryption and ask for a secure channel.
Reading the key as a researcher
Check where you got the key. RFC 9116 says researchers decide for themselves whether they trust a signing key. If the file is signed, the Canonical field is recommended so the signature covers the file's location. See writing and publishing security.txt for the rest of the file.
Quick check
Can I put the public key straight into security.txt?
No. The RFC says keys must not appear inline. Use the Encryption field with a link to the key.
Is a signed security.txt the same as an encryption key?
No. Signing proves who wrote the file. The encryption key is for researchers writing to you, and the RFC does not assume they are the same key.
Sources
Last reviewed: 19 October 2026.
