security.txt, standardized as RFC 9116, is a simple machine- and human-readable file served at /.well-known/security.txt that tells security researchers how to report vulnerabilities responsibly. It publishes contact details, an optional disclosure policy, encryption keys, and expiry, turning an organization’s vulnerability-disclosure posture into a discoverable, standardized signal.
security.txt
security.txt, standardized as RFC 9116, is a plain-text file served at /.well-known/security.txt that answers a single question for a security researcher who finds a problem: who do I tell, and how? It is the smallest possible standard for making an organization’s vulnerability-disclosure posture discoverable.
- Standardized fields -
Contact,Expires,Encryption,Acknowledgments,Policy,Preferred-Languages, and more, in a fixed, parseable format. - A well-known location - Served from the
/.well-known/path so both humans and crawlers can find it without guessing. - A cheap, honest trust signal - Publishing one is nearly free, so its presence or absence is a fast proxy for whether there’s a real security team behind an API or just an auditor.
Across the sectors I score, a published security.txt and a real vulnerability-disclosure program remain the exception rather than the rule — conspicuously so in industries handling the most sensitive data, like banking. That makes it one of the cheapest-to-fix trust gaps in the API economy, and one of the clearest machine-checkable signals of operational maturity around an API.
Governed by these regulations
A standard is the machine-readable contract; a regulation is the law that requires it. These are the regulations that mandate or drive this standard, catalogued at regulations.apievangelist.com.
EU Cyber Resilience Act (CRA)
The CRA obliges a coordinated vulnerability disclosure policy and a contact point for reporting; RFC 9116 is how that becomes machine-readable.
Product Security and Telecommunications Infrastructure Act 2022 (c. 46)
PSTI requires a published vulnerability disclosure policy with a working contact — exactly what security.txt exists to publish.
Cyber Security Act 2024 (Cth)
The smart-device standards carry the same vulnerability-disclosure requirement the UK's PSTI Act established.
