📄 Security.txt Generator

Build a security.txt file (RFC 9116) that tells security researchers how to report vulnerabilities. Publish the result at /.well-known/security.txt.

Contact (mailto: or https:, one per line)

Expires

Encryption (PGP key URL, optional)

Policy URL (optional)

Acknowledgments URL (optional)

Preferred Languages (comma-separated)

What the fields become

The file is assembled in your browser, one Field: value line each, in the order RFC 9116 examples use. Only two are required - Contact and Expires - and the date box is pre-filled a year ahead:

Contact: mailto:security@example.com
Expires: 2027-09-08T00:00:00.000Z
Policy: https://example.com/security-policy
Preferred-Languages: en

Contact takes one line per method and they are read in order of preference, so put the address you actually monitor first. The RFC asks for an Expires value less than a year out; if you want to sit strictly inside that, pull the default date back a day.

Publishing it

The path is exact. https://example.com/.well-known/security.txt, served as text/plain. A single-page app that answers unknown paths with index.html will return your app shell with a 200, which no parser accepts - fetch the URL and check what actually comes back.
Use a role address. security@ or a ticket queue, never an individual, since the file outlives the job.
Add Canonical yourself if you need it. This builder does not emit that field; it matters when the file is reachable at more than one hostname, or when you clear-sign the file with PGP.

Put a calendar reminder next to the Expires date. A file whose date has passed is treated as invalid, and it reads as a project nobody is watching.

Frequently asked questions

Where exactly does security.txt go?

In the .well-known directory at the root of your domain, over HTTPS. A copy at /security.txt is allowed as a fallback for older tooling, but the well-known path is the one scanners read.

Is the Expires field really mandatory?

Yes - it is the one field RFC 9116 added over the original draft, and files without it fail validation. It exists so a researcher can tell whether the contact details are still maintained.

Will publishing this bring a flood of junk reports?

You will get some automated low-quality mail, mostly scanner output and bounty-hunting boilerplate. A Policy URL that states your scope and says plainly whether you pay cuts most of it.