security.txt Generator
Generate a valid security.txt file with your vulnerability disclosure contact, policy link and expiry date.
About the security.txt generator
security.txt (RFC 9116) is a plain text file, served at /.well-known/security.txt, that gives security researchers a standard, predictable place to find out how to report a vulnerability, instead of having to search a site for a contact address that may not exist or may not reach the right team. This generator collects the fields the RFC defines: Contact, one or more ways to reach your security team such as an email address or a report submission URL; Expires, a mandatory date after which the file should be considered stale and should be refreshed; and optional fields like Policy, linking to your disclosure policy, and Preferred-Languages.
The Expires field is easy to forget but required by the specification precisely because a stale, outdated contact is worse than none at all: a researcher who reaches a dead address may simply give up rather than find another way to report a real issue, so the generator prompts for a near-term date and reminds you to keep it current. The output is ready to publish exactly as generated, at the fixed path /.well-known/security.txt on your site's root, which is the only location the specification allows clients to look for it, so it must not be placed anywhere else or nested under another path.
Because the file has no effect until it is actually deployed at the exact required path, verifying it loads correctly at /.well-known/security.txt after publishing is worth doing immediately, rather than assuming a deployment step that touches unrelated files also picked up this one. Confirming it loads at that exact path immediately after deploying takes a moment and avoids the file quietly sitting in the wrong location for months without anyone noticing it was never actually reachable.
Common questions
- Where does the file need to live?
- At exactly /.well-known/security.txt under your site's root. That is the only path the specification allows clients to check, so it cannot be placed anywhere else.
- Why is the Expires field required?
- So a stale, outdated contact is not mistaken for a current one; researchers and automated tools are meant to disregard a file whose Expires date has already passed.
- Can I list more than one contact method?
- Yes, multiple Contact lines are allowed and recommended, such as both an email address and a report submission URL, giving researchers more than one way to reach you.
- Does security.txt replace a formal bug bounty program?
- No, it is a discovery mechanism, not a program by itself. It commonly links to a Policy URL where a fuller disclosure policy or bounty program, if one exists, is described.