Publish a security.txt that researchers can actually use

Someone found a hole in your site — where do they report it? RFC 9116 defines the answer, and this writes the file for you.

Tools used in this guide

The job

A security.txt at /.well-known/security.txt is the standard way to say 'report vulnerabilities here' — contact, expiry, optional encryption and acknowledgment links. Researchers look for it; scanners check it. Missing file = reports go to a random inbox or nowhere.

Fill the fields

Contact is required and must be a URI — mailto:, https:, tel:. Expires is required too, and the RFC wants it within about a year so stale files expire visibly. Add Encryption, Acknowledgments, Preferred-Languages, Canonical and Policy as needed.

Each URI field is validated — a mailto: typo or a bare domain that isn't a URI gets caught before you publish.
Expires uses ISO 8601 date-time format; pick next year's date and calendar a reminder to bump it.

Deploy notes

Serve it at /.well-known/security.txt (and optionally /security.txt) as text/plain. The RFC recommends signing the file with PGP if you publish a key — the generated file is unsigned; add your signature with your own tooling before upload.