The CVE Program's own FAQ still tells people to use PGP for sensitive communication with the MITRE CNA of Last Resort. It lists a 4096 bit key and notes the key was updated in March 2026. Django's security page offers an encryption key too, but calls it optional. Rails sends reporters to a web program page and does not mention PGP at all.
So three credible projects, three answers. The right one for a small company depends on who will actually read the reports.
What's affected
Anyone writing the "how to report" section of a disclosure policy. The options:
| Channel | Good for | Cost to you |
|---|---|---|
| Plain email to a shared mailbox | Low friction, reaches everyone | Reports cross the network and sit in mail archives |
| PGP encrypted email | Reporters who insist on encryption | Key custody, expiry, rotation, and someone who can decrypt on a Sunday |
| Web form or private reporting on a code host | Most reporters, attachments, a record of state | You depend on a platform, and notifications must reach a person |
RFC 9116 gives the rule for security.txt. The Encryption field must be a URI that points to where the key can be fetched, and keys must not appear in the field itself. It also says it is always the researcher's job to check that the key is one they trust, so publish the fingerprint on a page you control.
Django's page shows a sensible compromise. It asks for plain email first, offers a key ID for those who want encryption, and promises an acknowledgment within 3 working days either way.
What to do now
- Make the default channel the easiest one: a shared mailbox plus a web form or, for open source, GitHub private vulnerability reporting.
- Offer PGP only if at least two people hold the private key and have decrypted a test message this quarter.
- Publish the fingerprint on your
/securitypage and link the key from theEncryptionfield in security.txt. - Put the key expiry on a shared calendar. An expired key sends researchers back to plain email, or away.
- Say in your policy that unencrypted reports are fine. That removes the excuse to skip reporting.
Quick check
Can you paste an armored PGP key directly into the Encryption field of security.txt?
No. RFC 9116 says keys must not appear in the field. It must be a URI pointing to where the key can be retrieved.
