After the two required fields, add Policy first, then Encryption and Preferred-Languages if they apply. RFC 9116 treats every other field as optional: Encryption, Canonical, Policy, Acknowledgments, Preferred-Languages and Hiring. Each one answers a question a researcher would otherwise have to email you to ask.
The fields in one table
| Field | What it holds | Notes from RFC 9116 |
|---|---|---|
| Contact | Where to report | Required |
| Expires | When the file goes stale | Required, once only |
| Policy | Link to your disclosure policy | Optional |
| Encryption | URI of a key | Keys must not appear inline |
| Acknowledgments | Page crediting researchers | Optional |
| Preferred-Languages | Language tags for reports | Only once, equal priority |
| Canonical | The file's own URI | Useful with a signature |
| Hiring | Link to security jobs | Optional |
Which to add first
Policy. A researcher deciding whether to report wants to know what you promise: response times, scope and whether good faith testing is welcome. A link to a clear policy answers that before the first message. Our guide to writing a disclosure policy developers respect covers the contents.
Encryption comes second if you accept encrypted reports. Point to a key by URI. The RFC says keys must not be placed inline in the file.
Preferred-Languages
This field lists language tags for submitting reports. The RFC says it may appear only once and that the listed languages have equal priority. Include only languages your team can truly read, so a reporter is not left waiting on a translation step you do not have.
Acknowledgments
A page that credits researchers shows that reports lead somewhere. It is optional, but it supports the trust story for customers, since it shows people actually report and you actually respond. Only list people who agreed to be named.
Hiring
An optional pointer to security job openings. It is harmless, and for some teams useful. Skip it if you have nothing to point to.
Steps to build the file
- Start with Contact and Expires.
- Add Policy once the policy page is live and reviewed.
- Add Encryption only if someone monitors the encrypted channel.
- Add Preferred-Languages for the languages you can handle.
- Add Canonical if you sign the file.
- Check that the file is served over https as text/plain, UTF-8, under /.well-known/.
- Calendar the Expires renewal. See what Expires means.
Quick check
Can Preferred-Languages appear twice?
No. RFC 9116 says it may appear only once, with all listed languages at equal priority.
Can I paste my public key into the file?
No. Keys must not appear inline. Use the Encryption field with a URI.
Safeguard's compliance and evidence automation helps teams keep their disclosure and security documents current. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
