security.txt generator
Fill in this RFC 9116-compliant form to generate a security.txt file telling security researchers how to responsibly report a vulnerability to you.
The expiration date (Expires) is required by RFC 9116.
How it works
The security.txt file, standardized by RFC 9116, lets a security researcher who finds a vulnerability on your site know right away who to contact and how, without having to guess an email address. Fill in the fields matching the standard directives, then download the generated file.
Where should I put the generated file?
Place it at /.well-known/security.txt at the root of your domain name (for example https://example.com/.well-known/security.txt). Some crawlers also check /security.txt at the root for compatibility, so you can place an identical copy there.
Why is the Expires field required?
RFC 9116 requires an expiration date so that a forgotten, outdated file doesn't keep pointing researchers to a contact that is no longer valid. Remember to regenerate and republish the file before that date, with a new expiry.
Is the Canonical field required?
No, but it's recommended: it gives the official URL of the file itself, which avoids any ambiguity if the file is found through a copy or mirror rather than at its original location.
Privacy: this form works entirely in your browser, and none of the data you enter is sent to a server.