security.txt
A plain text file at /.well-known/security.txt, defined in RFC 9116, that tells security researchers how to report a vulnerability to a website owner.
security.txt is defined in RFC 9116. The file must include at least one Contact field and an Expires date, and can point to a disclosure policy, an encryption key, preferred languages and the file's canonical location.
It exists because researchers who find a problem often can't work out whom to tell. A security.txt file answers that in a standard place that tools and people both know to check.
Every Notice Labs trust center serves a security.txt of its own at /.well-known/security.txt, built from its report form and security contact.
What a reviewer wants to see
- A file at /.well-known/security.txt that hasn't expired
- A contact that reaches the security team
- A Policy field pointing to your disclosure policy