To publish security.txt, put a plain text file at /.well-known/security.txt on your HTTPS site with a Contact line and an Expires line, then link a short disclosure policy from your trust page. RFC 9116 requires only those two fields. The rest is optional but useful.
What the standard says
RFC 9116 defines the file. It belongs under the /.well-known/ path on an HTTPS URL, with a copy at the top level allowed for legacy reasons. Contact and Expires are the required fields, and Expires appears only once. The RFC recommends setting Expires less than a year ahead, and recommends signing the file with an OpenPGP cleartext signature, in which case you should also include the Canonical field so the signature confirms where the file lives.
A minimal file
Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00.000Z
Preferred-Languages: en
Policy: https://example.com/security/disclosure
Canonical: https://example.com/.well-known/security.txt
Use a mailbox that several people can read. A single person's inbox fails the day they are on leave.
Put the expiry in a calendar
The Expires field is a feature: a stale file tells researchers the contact may be dead. Set a calendar reminder two months before it. An expired file is worse than none in some eyes, because it advertises neglect.
What the disclosure page should say
Keep it to a page. Cover:
- Scope. Which domains and products are in scope, and which are not.
- How to report. The address and what to include, such as steps to reproduce and affected URLs.
- What you promise. An acknowledgement time you can meet, and that you will keep the reporter informed.
- Safe harbour. Whether you will take legal action against good faith research that follows the rules. Have your lawyer word this.
- Rules. No data exfiltration beyond proof, no service disruption, no social engineering of staff.
- Rewards. Say plainly if you do not pay bounties.
Make sure someone triages
A contact that nobody reads is the common failure. Route the mailbox to your ticketing system, assign a weekly owner, and test it by sending a message from an outside account.
Link it from the places reviewers look
Reference the policy on your trust page, in your footer and in questionnaire answers about vulnerability management. See also what to publish on a trust page.
Sources
Quick check
Is security.txt mandatory?
No. It is a convenience standard. It does help researchers find the right contact quickly.
Should the file be signed?
RFC 9116 recommends it. If you sign, include the Canonical field.
Last reviewed: 19 October 2026.
