Security.txt Generator (RFC 9116)

Generate and validate RFC 9116 compliant security.txt files for vulnerability disclosure policies

Security.txt Presets

Select standard organizational disclosure profiles

Directives Configuration

Configure RFC 9116 security disclosure directives

Contact *

Required

Must begin with mailto:, https://, or tel: for vulnerability reports intake.

Expires *

Expires in 366 days (Tue, 12 Oct 2027 23:59:59 GMT)

Encryption (PGP Key URI)

Canonical URI

Policy URI

Acknowledgments (Hall of Fame)

Preferred-Languages

Hiring (Security Careers)

Custom Comments & Notes

RFC 9116 Compliant

RFC 9116

All mandatory RFC 9116 fields are present and correctly formatted.

/.well-known/security.txt

# Our security address and vulnerability disclosure program
# Generated per RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)

Contact: mailto:security@example.com
Expires: 2027-10-12T23:59:59.000Z
Encryption: https://example.com/pgp-key.txt
Acknowledgments: https://example.com/security/hall-of-fame
Preferred-Languages: en, es
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Hiring: https://example.com/careers/security

# Additional Notes:
# Please encrypt sensitive reports using our PGP public key.

Standard Deployment Location

Deploy this file to your server root under the .well-known directory:

https://yourdomain.com/.well-known/security.txt