Security.txt: A Contact File for Security Researchers
Security.txt is a standard contact file for vulnerability reports. Learn the required fields and where the file must live.
What is the Security.txt Generator?
A security.txt file gives security researchers a standard way to contact you about vulnerabilities. This generator builds the contact, expiry and policy lines.
How to use it
- Enter a contact and expiry date.
- Optionally add a policy URL.
- Click Generate and place the file under /.well-known/.
Worked example
A contact email plus an expiry date produces a complete security.txt.
Which sites need security.txt?
Any public site benefits, but it is most valuable for sites handling accounts, payments or personal data.
Frequently asked questions
Where does security.txt live?
Under /.well-known/security.txt (preferred) or at the site root.
Is an expiry date required?
It is recommended so researchers know the contact is current.