security.txt Generator (RFC 9116)
Build the file that tells security researchers how to report a vulnerability to you.
Runs in your browser — nothing is uploadedAn address or page a researcher can reach you at. The only required field.
Your disclosure policy: what is in scope and what you promise in return.
A public key, so a report containing details can reach you encrypted.
A page thanking the people who have reported issues.
Where this file officially lives. Guards against a copy being passed off as yours.
Optional, and surprisingly effective: the people reading this file are the ones you want.
What security.txt is
A plain text file at /.well-known/security.txt that answers one question: someone
has found a security problem on your site — who do they tell? Without it, a researcher acting
in good faith ends up guessing at info@, messaging you on social media, or giving
up. It is defined by RFC 9116 and takes two minutes to publish.
Where to put it
At https://yourdomain.com/.well-known/security.txt, served over HTTPS as text/plain. That exact path is the whole point — automated scanners and
researchers look there and nowhere else. A copy at /security.txt is allowed as a
fallback, but the .well-known location is the one that counts.
Expires is required, and that is deliberate
RFC 9116 makes the Expires field mandatory so the file cannot quietly rot. A
contact address from four years ago that nobody reads is worse than none at all, because
reports vanish into it. Set a year, put a reminder in the calendar, and update the date when
you check that the address still works.
Point it somewhere a person reads
The single most common mistake is a contact address that goes to a ticket queue nobody monitors. Use an address that reaches someone who can act, and if you can, publish a short policy saying what is in scope and how you will respond. Researchers are far more likely to report to somebody who has said in advance that they welcome it.
Other free tools
Need the whole website, not just the snippet?
Describe it in a sentence and relivo builds it — free until you put it online.