Security.txt Generator

Understanding RFC 9116 & the security.txt Standard

When ethical security researchers discover a vulnerability on a public website or web application, finding the appropriate point of contact is notoriously difficult. Bug reports sent to generic sales or support email addresses often go ignored or misrouted. In April 2022, the Internet Engineering Task Force (IETF) standardized RFC 9116, establishing the security.txt protocol to provide a machine-readable and human-readable mechanism for organizations to define their security contacts and disclosure policies.

Analogous to how robots.txt informs search crawlers and humans.txt credits developers, security.txt resides in the standard /.well-known/security.txt directory on web servers. Implementing this file enables white-hat researchers to report zero-day flaws promptly and responsibly before malicious adversaries exploit them.

RFC 9116 Mandatory & Recommended Directives

• Contact (Mandatory): The direct URI (e.g. mailto:security@domain.com or https://hackerone.com/company) where researchers submit reports.
• Expires (Mandatory): The ISO 8601 date and time after which the data should be considered stale. This prevents abandoned web assets from advertising obsolete contacts.
• Canonical: The authoritative URL where the file is hosted (e.g., https://domain.com/.well-known/security.txt).
• Encryption: Link to your PGP/GPG public key so researchers can encrypt sensitive vulnerability disclosures.
• Policy: Link to your responsible disclosure guidelines and safe harbor commitments.

Building an Enterprise Security Vulnerability Disclosure Program

In modern DevSecOps and enterprise cybersecurity, establishing a clear channel for responsible vulnerability disclosure is an essential component of SOC 2, ISO 27001, and NIST Cybersecurity Framework compliance. Historically, security researchers who identified critical remote code execution (RCE) flaws or SQL injections on corporate web properties struggled to find technical contacts, often resorting to tweeting executives or submitting generic contact forms that risked exposing sensitive exploits to untrusted staff.

RFC 9116 standardizes vulnerability intake, establishing the /.well-known/security.txt file as the universal beacon for white-hat security researchers. By publishing explicit PGP encryption keys, security disclosure policies, and safe harbor legal protections, organizations foster positive collaboration with global cybersecurity researchers while protecting user data.

Step-by-Step Server Deployment Guide

1. Generate File Content: Use the interactive generator above to specify your contact URI, PGP public key link, policy URL, and expiration date.
2. Create the .well-known Directory: In your web server's public root directory (e.g. public_html, /var/www/html, or dist/), create a directory named .well-known.
3. Save and Upload: Save the output as a plain text UTF-8 file named security.txt inside the .well-known directory.
4. Verify Server Headers: Ensure your web server (Nginx, Apache, Caddy, or Cloudflare) serves the file with a Content-Type: text/plain; charset=utf-8 HTTP response header.
5. Test Public Resolution: Navigate in your web browser to https://yourdomain.com/.well-known/security.txt and confirm the file loads with zero redirects and valid HTTPS certificates.