Signing is recommended, not required. RFC 9116 recommends that security.txt be digitally signed with an OpenPGP cleartext signature, and that a signed file include the Canonical field. A signature lets a researcher confirm the contact details came from you and were not tampered with.
Definitions
A cleartext signature keeps the file readable as plain text and appends a signature block that a tool can verify. The Canonical field gives the URI where the file is meant to live. With a signature, it lets a reader confirm the file is being served from the location its author intended.
Keep Canonical identical to the address where you actually serve the file.
Why bother
A security.txt file tells strangers where to send vulnerability reports. If an attacker could alter it, reports might go to the wrong place. HTTPS already protects the transfer. A signature adds protection that survives copying, caching or mirroring.
For a small team the cost is low. For a buyer reviewing your security page, a signed file with a valid date is a quiet sign of care.
What the RFC says in brief
| Topic | Statement |
|---|---|
| Signing | Recommended, using an OpenPGP cleartext signature |
| Canonical | Optional field holding the file's own URI |
| Encryption | Optional URI pointing to a key; keys must not appear inline |
| Location | Under /.well-known/, served over https as text/plain with UTF-8 |
| Expires | Required, and recommended to be under a year ahead |
Steps to sign
- Create or choose an OpenPGP key controlled by your security team, not one person's personal key.
- Write the file with Contact, Expires and Canonical, plus Policy and Encryption if you have them.
- Produce a cleartext signature over the whole file.
- Publish it at /.well-known/security.txt over https.
- Fetch the live file from outside your network and verify the signature.
- Put key rotation and Expires renewal on one shared calendar. See what Expires means.
Pitfalls
- Editing the file after signing, which breaks verification.
- Letting the signing key expire before the file does.
- Putting the public key inline. The RFC says keys must not appear inline, so link to it with Encryption instead.
- Leaving a different copy at the top level path. The RFC says the /.well-known/ copy takes precedence if both exist, so keep them identical or redirect.
Quick check
Is signing mandatory?
No. It is recommended. Only Contact and Expires are mandatory.
What does Canonical do?
It states the URI where the file is located, so that with a signature a reader can confirm the file is where its author put it.
Safeguard's SBOM and dependency scanning help teams keep track of what they ship and where it came from. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
