security.txt generator
Create a security.txt file that tells researchers how to report a vulnerability to you. Fill in a few fields, check the preview, and download a file that follows RFC 9116.
Free, no sign-up. Everything runs in your browser; nothing you type is sent anywhere.
How to publish it
- Download the file and save it as security.txt.
- Upload it so it's served at https://yourdomain/.well-known/security.txt, as plain text over HTTPS.
- Check it loads in a browser, and that the contact address reaches someone who reads it.
- Put a reminder in the calendar to update it before the Expires date, which must be less than a year away.
Every Notice Labs trust center already serves one
If you'd rather not maintain a file yourself, a Notice Labs trust center serves its own security.txt at /.well-known/security.txt on its own address. It's built from your trust center: a Contact line for the Report a vulnerability form while the form is on, a Contact line for your security address, and an Expires date that moves forward each time the file is fetched.
From £39 a month. No sales call.
- 01Create a Notice Labs trust center and set your security contact.
- 02Researchers reach the form from a link that opens it directly: your trust center's address followed by #report-vulnerability.
- 03The file is served on your trust center's address, at your custom domain once it's verified. If your main website needs its own file, use the generator above and point its Contact at the trust center.
Questions
Straight answers about the file and what goes in it.
What is security.txt?
A plain text file, defined in RFC 9116, that sits at /.well-known/security.txt on a website and tells security researchers how to report a vulnerability to its owner.
Which fields are required?
At least one Contact field and exactly one Expires field. Policy, Preferred-Languages, Canonical, Encryption, Acknowledgments and Hiring are optional.
What should the Expires date be?
RFC 9116 recommends a date less than a year in the future, so the file is kept current. Update it before it passes; an expired file tells researchers the contact may be stale.
Can Contact be a web page instead of an email?
Yes. Contact can be an email address written as a mailto: link, a phone number, or an https URL such as a page with a report form. You can list several, in order of preference.
Should the file be signed?
RFC 9116 recommends signing it with OpenPGP so researchers can check it's genuine. It's optional, and an unsigned file is far better than none.
Does Notice Labs host security.txt for me?
A trust center with its report form on, or a security address set, serves its own security.txt on its own address, built from its report form and security contact. It doesn't put a file on your main domain: for that, publish the file this generator makes.