← All Tools

🛡 security.txt Generator

Build a compliant /.well-known/security.txt file (RFC 9116) so security researchers know how to report vulnerabilities to your organization.

100% client-side processing. No data is sent to any server. No storage, no cookies, no tracking. Your inputs never leave your browser.

What is security.txt?

RFC 9116 defines a standard text file at https://example.com/.well-known/security.txt (and optionally /security.txt) that tells security researchers how to responsibly report vulnerabilities. It is widely adopted by GitHub, Google, Cloudflare, governments, and most major SaaS vendors.

Best practice: serve the file over HTTPS, sign it with PGP, set Expires no more than 1 year in the future, and review it on a regular schedule.

Contact * One per line. Email (mailto:), web form (https://), or phone (tel:).

Expires * Date after which this file is no longer considered valid. RFC 9116 recommends ≤ 1 year.

Encryption URL to a PGP key (https:// or dns: or openpgp4fpr:). One per line.

Acknowledgments Page that thanks researchers who reported issues responsibly.

Preferred-Languages Comma-separated BCP 47 codes (e.g. en, fr, de). At most one line allowed.

Canonical Canonical URI(s) where this file is hosted. Helps researchers verify they are reading the authoritative copy.

Policy URL of your responsible disclosure / vulnerability reporting policy.

Hiring Optional link to security-related job openings.

CSAF Provider-metadata URL for CSAF (Common Security Advisory Framework) feeds.

Comments / Header Optional banner that will be added as # comment lines at the top.

Generated security.txt

Deployment checklist

Save the generated file as security.txt.
Upload to https://your-domain.tld/.well-known/security.txt (case-sensitive path).
Serve over HTTPS with Content-Type: text/plain; charset=utf-8.
Optionally also place a copy at /security.txt as a fallback.
If you set Encryption, sign the file with the matching PGP key (gpg --clear-sign security.txt) and serve the .asc output.
Diary a calendar reminder a few weeks before Expires to refresh the file.

Why publish security.txt?

Lower mean time to report. Researchers stop guessing where to send a finding and email you instead of disclosing publicly.
Required or recommended by many bug bounty platforms and government VDPs (CISA BOD 20-01 in the U.S., NCSC guidance in the U.K.).
Cheap signal of maturity. Many enterprise procurement reviews check for it.
Helps with NIS2 / DORA demonstration of vulnerability handling processes.