Security.Txt

Created by EdOverflow and Yakov Shafranovich, the project gives security researchers a clear, consistent way to contact website owners when they discover security risks. Its site provides guidance, a specification, frequently asked questions, and an interactive tool for preparing a security.txt file.

Organizations can publish the plain-text file in the website’s /.well-known/ directory, with the root directory available as a fallback. The tool supports fields for security contacts, expiration dates, encryption keys, acknowledgments, preferred languages, canonical file locations, disclosure policies, security job listings, and CSAF provider metadata. It also explains requirements such as serving the file over HTTPS and using appropriate contact formats. Users can copy their completed file and may digitally sign it with an OpenPGP cleartext signature to help confirm its authenticity.

The project aims to make vulnerability disclosure easier for both companies and researchers.