security.txt, standardized as RFC 9116, is a simple machine- and human-readable file served at /.well-known/security.txt that tells security researchers how to report vulnerabilities responsibly. It publishes contact details, an optional disclosure policy, encryption keys, and expiry, turning an organization's vulnerability-disclosure posture into a discoverable, standardized signal.
security.txt
security.txt, standardized as RFC 9116, is a plain-text file served at /.well-known/security.txt that answers a single question for a security researcher who finds a problem: who do I tell, and how? It is the smallest possible standard for making an organization’s vulnerability-disclosure posture discoverable.
- Standardized fields -
Contact,Expires,Encryption,Acknowledgments,Policy,Preferred-Languages, and more, in a fixed, parseable format. - A well-known location - Served from the
/.well-known/path so both humans and crawlers can find it without guessing. - A cheap, honest trust signal - Publishing one is nearly free, so its presence or absence is a fast proxy for whether there’s a real security team behind an API or just an auditor.
Across the sectors I score, a published security.txt and a real vulnerability-disclosure program remain the exception rather than the rule — conspicuously so in industries handling the most sensitive data, like banking. That makes it one of the cheapest-to-fix trust gaps in the API economy, and one of the clearest machine-checkable signals of operational maturity around an API.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of US Insurance APIs
One organization in twenty-four serves a real RFC 9116 security.txt — and one serves an HTTP 200 that is a single-page-app shell, a false positive scanners will bank.
The State of Australian Banking APIs
A published security.txt remains the exception across Australian banking — a cheap-to-fix trust gap the report calls out.
The State of Market Data APIs
Disclosure programs are rare in market data — a published security.txt is a fast proxy for a real security team.
