security.txt generator

Build a security.txt file per RFC 9116 so security researchers know how to report vulnerabilities. Serve it at /.well-known/security.txt over HTTPS.

~~~

Contact (required)

Expires (required)

Encryption URL

Acknowledgments URL

Preferred-Languages

Canonical URL

Policy URL

Hiring URL

Validation

Output

~~~

About this tool

security.txt is a plain-text file that tells researchers how to contact you about security issues. Publish it at https://yourdomain.com/.well-known/security.txt (HTTPS only). The format is defined in RFC 9116.

Contact and Expires are required fields. Contacts must use mailto: or https:// URIs. Keep Expires current — the RFC expects you to refresh it regularly (within about a year).

You can optionally PGP-sign the published file for authenticity; this tool does not handle signing.

~~~

Related tools

Free books, courses, and software

Get my programming books, course editions, and complete software.

Get the download library →