security.txt generator
Tell security researchers how to reach you. Fill in a few fields, download the file, publish it in /.well-known/.
/.well-known/security.txt
Contact: mailto:[email protected] Expires: 2027-10-27T03:59:59.000Z Preferred-Languages: fr, en
Publish this file at /.well-known/security.txt, served as text/plain over HTTPS. Contact and Expires are required (RFC 9116); use a date less than a year away and renew it.
The fields
- Contact (required): email, form or phone. Prefer a generic address that survives staff changes.
- Expires (required): the date after which the file is no longer reliable.
- Preferred-Languages: the languages you prefer to receive reports in.
- Canonical, Policy, Acknowledgments, Encryption: optional but useful.
Receiving a report means knowing what to do with it: decide who handles it in your incident response plan.
Frequently asked questions
What is security.txt for?+
It’s a standard file (RFC 9116) telling security researchers how to report a vulnerability to you. Without it, a good-faith report may get lost or never arrive.
Where do I put the file?+
At https://your-domain/.well-known/security.txt, served as plain text (text/plain) over HTTPS.
What goes in Expires?+
A date less than a year away. The file is considered stale after that date: set a reminder to update it.