Security.txt Generator
Build RFC 9116 security.txt content with required contacts, expiry, and optional disclosure fields.
Website and Contact
Disclosure Details
Options
For web-based services, publish the file at /.well-known/security.txt over HTTPS with text/plain; charset=utf-8.
Output
Generated security.txt content will appear here.
Creating a Security.txt File for Vulnerability Reports
A security.txt file gives security researchers a clear way to report vulnerabilities. Instead of guessing who to contact, they can check a standard location on your website and find your preferred contact, policy, expiry date, and encryption details.
The generated file follows the field model in RFC 9116: at least one Contact field, exactly one Expires field, and optional fields such as Canonical, Policy, Encryption, Acknowledgments, Preferred-Languages, and Hiring. Publish the final file at /.well-known/security.txt on the domain it describes.
Important Security.txt Fields
- Contact tells researchers where to send reports.
- Expires tells readers when the file should be considered stale.
- Canonical points to the official security.txt URL.
- Policy links to vulnerability disclosure rules and scope.
- Encryption points to a key for encrypted reports.
- Acknowledgments links to a page recognizing valid reports.
Keep Security.txt Practical
A security.txt file is most useful when the contact actually works. Use an email inbox or form that someone checks, and link to a policy that explains what is in scope, what is out of scope, and what researchers should expect after submitting a report.
Review the file before the Expires date so researchers do not rely on stale information.
Example Security.txt Content
Contact: mailto:security@example.com Expires: 2027-06-01T00:00:00Z Canonical: https://example.com/.well-known/security.txt Policy: https://example.com/security-policy Preferred-Languages: en