Free tool

Free security.txt Generator for RFC 9116

The generator writes the security.txt file under RFC 9116, with the vulnerability disclosure policy it links to, ready to upload to your website.

Build your security.txt Vulnerability Disclosure Policy Generator
  • Contact
  • Expires
  • Policy
  • Encryption

Build your security.txt file.

Complete 3 steps and copy the results in step 4.

Tell us about your organization

The page where you'll publish the policy. The security.txt file links to it.

One per line. Leave it empty to cover your website and its subdomains.

Choose how people report

Fill in at least 1 way to report. The security.txt file lists them in this order.

Your program page on a platform such as HackerOne, Bugcrowd, Intigriti or YesWeHack.

Less than a year from today. Update the file before this date.

A link to your public key, which researchers use to encrypt their reports. The file links to the key and doesn't hold it.

Set the rules

Rewards
Test methods that aren't allowed
security.txt

The file at its address on your website, and the policy at a glance.

Copy your policy and security.txt

Review the text before you publish it. It follows your answers above.

Enter your organization name to see your policy and security.txt file.

The generator writes text from your answers, RFC 9116 and common disclosure policy templates, such as the one from the US Cybersecurity and Infrastructure Security Agency (CISA). It isn't legal advice. Review the policy before you publish it, and check the safe harbor wording with a lawyer: it covers only what your organization does, not what other parties or prosecutors do.

Where to put your security.txt file.

The file goes at a fixed address on your website, so tools and researchers find it without searching.

  1. Download the file. Save it as security.txt, in plain text with UTF-8 encoding.

  2. Upload it to /.well-known/. Put it at https://your-domain/.well-known/security.txt. On some hosts you create the .well-known folder yourself, with your file manager or FTP.

  3. Check the address. Open the file in a browser. It loads over HTTPS as plain text (Content-Type: text/plain), without a redirect to another domain.

  4. Cover your other domains. The file covers only the domain that serves it. Add it to each domain and subdomain you want reports about.

  5. Publish the policy. Put the disclosure policy at the link on the Policy line.

  6. Set a reminder. Update the Expires line before the date passes, and sign the file again if you signed it.

The rules

What the rules ask.

Each row names a law, a standard or a government directive, when it applies, and what it asks of your disclosure policy.

Laws and standards for vulnerability disclosure, when each applies, and what it asks
Law or standard When it applies What it asks
RFC 9116 (security.txt) Any website. It's a voluntary internet standard. A plain text file at /.well-known/security.txt, served over HTTPS, with at least 1 Contact line and an Expires date, ideally less than a year ahead.
EU Cyber Resilience Act (Regulation (EU) 2024/2847) Makers of software and connected products sold in the EU. Reporting applies from September 11, 2026, the other requirements from December 11, 2027. A coordinated vulnerability disclosure policy and a contact address for reports (Annex I, Part II), a single point of contact named in the user information (Annex II), and reports of actively exploited vulnerabilities to ENISA within 24 hours.
NIS2 Directive (EU) 2022/2555 Essential and important entities in the EU, such as cloud, hosting and digital infrastructure providers. Vulnerability handling and disclosure as part of the security measures (Article 21). National CSIRTs coordinate disclosure between researchers and companies (Article 12).
UK Product Security and Telecommunications Infrastructure (PSTI) regime Makers of connectable consumer products sold in the UK, since April 29, 2024. A published way to report security issues, and the time within which reporters get an acknowledgement and status updates.
CISA Binding Operational Directive 20-01, US US federal civilian agencies. Its policy template is a common model for companies. A published policy with the systems in scope, how to report, a commitment not to pursue legal action for good-faith research, and an acknowledgement of reports within 3 business days.
ISO/IEC 29147 and ISO/IEC 30111 Any organization. They're international standards, often asked for in security reviews. How to receive reports and publish advisories (29147), and how to confirm, fix and track each report inside your organization (30111).

Acceptable Use Policy Generator

Your Acceptable Use Policy sets the rules for everyone else.

The TermsFeed Acceptable Use Policy Generator forbids probing or testing your service without written permission, and asks users to report vulnerabilities to you. Your disclosure policy gives that permission to researchers who follow it.

Generate Acceptable Use Policy

Frequently asked questions.

Answers to common questions about security.txt.

What is security.txt?

security.txt is a plain text file that tells security researchers how to report a vulnerability on your website.

  • RFC 9116 describes it, as an internet standard since April 2022.
  • It lives at /.well-known/security.txt.
  • It lists your security contacts, an expiry date, and links such as your disclosure policy and encryption key.

Which fields does security.txt need?

A security.txt file needs at least 1 Contact line and exactly 1 Expires line.

  • Contact: an email (mailto:), a link (https://) or a phone number (tel:), in the order you prefer.
  • Expires: the date and time after which the file is stale.
  • Optional: Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical and Hiring.

What happens when security.txt expires?

After the Expires date, researchers and tools treat the file as stale, and its contacts as unreliable.

  • RFC 9116 recommends an Expires date less than a year ahead.
  • Update the date each time you check the contacts.
  • Security scanners often report an expired file as an issue.

Should I sign my security.txt file?

Signing is optional. A signature shows the file wasn't changed by someone else.

  • Use an OpenPGP cleartext signature, such as gpg --clearsign security.txt.
  • Keep the Canonical line, so the signed file names its own address.
  • Sign again after each change, the new Expires date included.

Does security.txt replace a vulnerability disclosure policy?

No. security.txt says where to report. The policy says what researchers are allowed to test and what you do with a report.

The Policy line of the file links to the policy. The generator above writes both.

Is the security.txt Generator free?

Yes, the security.txt Generator is free.

  • The generator needs no account.
  • The generator writes the vulnerability disclosure policy too.

Build your security.txt file with the generator above.