Result
Your security.txt
Location
WaitingThe file lives at /.well-known/security.txt on the exact host, over HTTPS.
Waiting for a checkRFC 9116, Section 3: Location of the security.txt FileMedia type
WaitingThe response says text/plain with the charset set to utf-8.
Waiting for a checkRFC 9116, Section 3: Location of the security.txt FileRedirects
WaitingA redirect is allowed, but one that leaves the host is worth a look, and the file then speaks only where Canonical says.
Waiting for a checkRFC 9116, Section 5.2: RedirectsFormat
WaitingUTF-8 text where every line is a field, a comment, or blank, within the limits a parser may refuse.
Waiting for a checkRFC 9116, Section 4: File Format Description and ABNF GrammarContact
WaitingRequired. A mailto, tel, or https URI for reporting, listed in order of preference.
Waiting for a checkRFC 9116, Section 2.5.3: ContactExpires
WaitingRequired, once. An RFC 3339 date-time after which the file is stale, ideally under a year away.
Waiting for a checkRFC 9116, Section 2.5.5: ExpiresCanonical
WaitingOptional. The addresses where this file lives. When set, the address it was read from must be among them.
Waiting for a checkRFC 9116, Section 2.5.2: CanonicalSignature
WaitingOptional and recommended. An OpenPGP cleartext signature over the file, with Canonical beside it.
Waiting for a checkRFC 9116, Section 2.3: Digital Signature
The optional fields
- EncryptionWaiting
Waiting for a checkWhere to fetch the key for encrypted reports. A URI, never the key itself.
RFC 9116, Section 2.5.4: Encryption - PolicyWaiting
Waiting for a checkThe disclosure policy, and the place to say whether testing is permitted.
RFC 9116, Section 2.5.7: Policy - AcknowledgmentsWaiting
Waiting for a checkThe page that thanks researchers.
RFC 9116, Section 2.5.1: Acknowledgments - HiringWaiting
Waiting for a checkSecurity job openings.
RFC 9116, Section 2.5.6: Hiring - Preferred-LanguagesWaiting
Waiting for a checkLanguage tags for reports, once, comma separated, all of equal priority.
RFC 9116, Section 2.5.8: Preferred-Languages - Extension fieldsWaiting
Waiting for a checkAny other field. Researchers ignore what they do not support.
RFC 9116, Section 2.4: Extensibility
The file to publish
Save it as .well-known/security.txt among the site's static files, served as text/plain; charset=utf-8. The blog says where that folder is on common hosts.
The file as received
Rules fromRFC 9116, security.txtRead against the source on 2026-09-03. Every row links its section.
Response fromthe checked address