security.txt generator

A security.txt file tells security researchers how to report a vulnerability in your site, and when the information was last confirmed current. This builds a valid RFC 9116 file - fill in your details and copy or download it. Everything runs in your browser; nothing is sent anywhere.

Contact required

An email, a tel:, or an https:// URL. A bare email becomes mailto: automatically.

Expires required

When this file should be revisited. RFC 9116 suggests under a year.

Encryption

Policy

Acknowledgments

Canonical

Hiring

Preferred-Languages

Comma-separated language tags, most-preferred first.

At least one Contact is required.

Generated /.well-known/security.txt

# security.txt - RFC 9116. Generated with headers.0x6a03448f4d.com
# Serve at https://<domain>/.well-known/security.txt over HTTPS as text/plain.

Expires: 2027-10-18T00:00:00.000Z

Save this as /.well-known/security.txt, served over HTTPS as text/plain. For extra assurance you can PGP-sign it (a cleartext signature) and point Encryption at your public key. Then run a scan to confirm it's served and parsed correctly.