What is RFC 9116 (security.txt)?
An IETF standard defining a canonical machine-readable text file hosted under /.well-known/security.txt where organizations publish responsible vulnerability disclosure guidelines.
Canonical Path and Mandatory Directives
RFC 9116 standardizes the placement of security contact details at `/.well-known/security.txt`. This eliminates friction when ethical researchers discover critical vulnerabilities and need to contact security engineers immediately.
The standard mandates two directives: `Contact` (URI to reporting email or bug bounty portal) and `Expires` (ISO 8601 UTC timestamp after which the data must be considered stale).
Key Advantages & Impact
- Accelerates incident triage by directing vulnerability reports to security teams rather than sales inboxes
- Supports OpenPGP cleartext signatures to prevent unauthorized file tampering
- Satisfies enterprise security governance audits (SOC 2, ISO 27001, NIS 2)
Common Misconceptions vs Reality
Experience This Technology in DocSwift Tools
Frequently Asked Questions
Is the Expires directive strictly required in security.txt?
Yes. Under RFC 9116, files lacking an unexpired `Expires:` date are treated as invalid by automated security crawlers.
Can I sign my security.txt with GPG?
Yes. RFC 9116 recommends signing the file using OpenPGP cleartext signatures to prove authenticity.