A security.txt file is a short plain-text file on a website that says how to report a security problem to that organization. It is defined in RFC 9116. If you rely on a vendor's software, its presence is a quick sign that the vendor expects, and has planned for, bug reports.
What it is
RFC 9116 defines security.txt as a machine-readable way for organizations to publish their vulnerability disclosure practices, so researchers know where to send a report. The RFC is Informational, not a formal standard, and it complements other public security resources rather than replacing them.
Where to find one
For web services, the file belongs at the well-known path on the domain. For a vendor at example.com, that means:
https://example.com/.well-known/security.txt
The RFC allows a copy at the top level of the site for older setups, but says the well-known location wins if both exist. It must be served over HTTPS as plain text. It applies only to the exact domain it sits on, not to subdomains or parent domains.
What is inside
Two fields are required:
| Field | What it holds |
|---|---|
| Contact | How to reach the security team, as an email link, phone number or web page. Several can be listed in order of preference |
| Expires | A date after which the file should be treated as stale. The RFC recommends less than a year ahead |
Optional fields include Acknowledgments, Canonical, Encryption, Hiring, Policy and Preferred-Languages. The RFC recommends signing the file with OpenPGP and including a Canonical field.
Here is a simple example:
Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00Z
Policy: https://example.com/security-policy
How to check a vendor's file in under a minute
- Open the vendor's main site in your browser.
- Add the well-known path to the address and press enter.
- Look for a Contact line and an Expires date.
- If the Expires date has passed, the file is stale. That is a small warning sign, not proof of a problem.
- Follow the Policy link, if any, to see how reports are handled.
What a missing file means
Not much, by itself. Plenty of careful vendors publish a disclosure policy on a security page instead. CISA's product security bad practices guidance flags not having a published vulnerability disclosure policy that covers the product. So the real test is whether any clear, current reporting route exists, in whichever form.
Why it helps users
A reporting route makes it more likely that a researcher who finds a flaw tells the vendor first. That shortens the time before a fix ships, which is good for everyone using the product.
Where Safeguard fits
If you ship software yourself, this is a cheap file to add. Pair it with dependency scanning and an SBOM so that when a report arrives, you can quickly tell which releases contain the affected component. Safeguard scans dependencies and builds SBOMs, and you can start with the free scan at gold.safeguard.sh/scan.
Quick check
Is security.txt mandatory?
No. RFC 9116 is Informational. It is a convention that makes reporting easier, not a legal requirement.
Does a security.txt file make a vendor secure?
No. It shows there is a reporting route. It says nothing about how quickly or well problems are fixed.
Sources
- RFC 9116: A File Format to Aid in Security Vulnerability Disclosure
- CISA: Product Security Bad Practices
Last reviewed: 19 October 2026.
