security.txt, standardized as RFC 9116, is a simple machine- and human-readable file served at /.well-known/security.txt that tells security researchers how to report vulnerabilities responsibly. It publishes contact details, an optional disclosure policy, encryption keys, and expiry, turning an organization’s vulnerability-disclosure posture into a discoverable, standardized signal.
security.txt
security.txt, standardized as RFC 9116, is a plain-text file served at /.well-known/security.txt that answers a single question for a security researcher who finds a problem: who do I tell, and how? It is the smallest possible standard for making an organization’s vulnerability-disclosure posture discoverable.
- Standardized fields -
Contact,Expires,Encryption,Acknowledgments,Policy,Preferred-Languages, and more, in a fixed, parseable format. - A well-known location - Served from the
/.well-known/path so both humans and crawlers can find it without guessing. - A cheap, honest trust signal - Publishing one is nearly free, so its presence or absence is a fast proxy for whether there’s a real security team behind an API or just an auditor.
Across the sectors I score, a published security.txt and a real vulnerability-disclosure program remain the exception rather than the rule — conspicuously so in industries handling the most sensitive data, like banking. That makes it one of the cheapest-to-fix trust gaps in the API economy, and one of the clearest machine-checkable signals of operational maturity around an API.
