Publish both if you ship code on GitHub and run a website. SECURITY.md sits in a repository and explains supported versions and how to report a flaw. The security.txt file, defined in RFC 9116, sits at a well-known path on your domain so researchers and tools can find a contact without searching.
What each file is
SECURITY.md is a convention supported by GitHub. GitHub describes the security policy as instructions for how to report a security vulnerability in your project, and suggests adding supported versions and how to report. You can create it from the repository's security area.
The security.txt file is a standard. RFC 9116 says an organization must place it under the .well-known path, for example example.com/.well-known/security.txt, served over HTTPS as plain text in UTF-8. A top-level copy is allowed for legacy reasons, and the well-known one wins if both exist.
Side by side
| Question | SECURITY.md | security.txt |
|---|---|---|
| Where it lives | In a code repository | On your domain |
| Who finds it | People on the repo page | Researchers, scanners, anyone with the domain |
| Required content | None specified, advice is supported versions and reporting steps | Contact and Expires |
| Signing | Not applicable | OpenPGP cleartext signature recommended |
| Best for | Open source projects | Companies and products with a website |
What RFC 9116 requires
Two fields must be present. Contact must always appear, and Expires must appear exactly once. The RFC recommends an Expires date less than one year ahead to avoid a stale file. Optional fields include Acknowledgments, Canonical, Encryption, Hiring, Policy and Preferred-Languages.
Making them agree
The worst outcome is two files that give different contacts. Use one reporting address or form for both, and have security.txt point to the same policy URL that your SECURITY.md links. When you change your intake route, update both on the same day.
A simple rollout
- Pick a single reporting channel you will actually monitor.
- Write the security.txt with Contact and Expires, and add a Policy link.
- Add SECURITY.md to each public repository, with supported versions and the same channel.
- Put a calendar reminder before the Expires date.
For step by step guidance, see how to write a security.txt file and write a SECURITY.md.
Quick check
Which fields does security.txt require?
Contact, and Expires exactly once.
Does SECURITY.md replace security.txt?
No. They serve different places. One lives in a repository and the other on your domain.
Safeguard's asset discovery can help you find which of your domains and repositories lack a policy, and a free scan covers dependencies.
Sources
Last reviewed: 19 October 2026.
