security.txt Generator and Validator

Contact: mailto:security@example.com
Expires: 2027-02-08T23:59:59Z
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Preferred-Languages: en

What is security.txt?

security.txt is a plain-text file that tells security researchers how to report a vulnerability to an organization. It provides a predictable contact location when a site does not otherwise make its disclosure process easy to find.

Required fields and location

An RFC 9116 file needs at least one Contact field and an Expires field. Publish the authoritative file at:

https://example.com/.well-known/security.txt

Use the Canonical field to identify that exact location. Contact values are URIs, commonly mailto:security@example.com or an HTTPS vulnerability-report form. The expiry value forces organizations to review stale contact details.

Optional fields

• Policy links to disclosure rules, scope, and safe-harbor language.
• Encryption links to a public key for encrypted reports.
• Acknowledgments links to a researcher recognition page.
• Preferred-Languages lists languages understood by the response team.
• Hiring may link to relevant security positions.

Validation limits

The validator checks common structural requirements, URI schemes, canonical placement, and expiry. It does not fetch remote URLs, verify that a mailbox is monitored, validate an OpenPGP signature, or approve vulnerability testing. A syntactically valid file still needs an operational response process behind it.

Privacy and related tools

Generation and validation happen locally in your browser. MiniUtil does not receive contact addresses, policy URLs, or file contents. The format is defined by RFC 9116. Use the Cache-Control Header Builder to control how the file is cached, the SRI Hash Generator for external asset integrity, or the CSP Header Builder for browser resource restrictions.