Tools

security.txt validator

Paste a security.txt file and check it against RFC 9116: the required Contact and Expires fields, field syntax, https URIs, languages, the signature wrapper and where it is served.

LOCAL UTILITY / 07

Validate a security.txt file

Paste the text of a security.txt file and, if you like, the address it is served from. The file is checked against RFC 9116 and the IANA field registry in this browser; nothing is fetched or sent anywhere.

Loading the local validator… If this remains visible, refresh the page.

A file that passes

Serve the file at /.well-known/security.txt over https as text/plain with a UTF-8 charset, keep Expires less than a year ahead and review it before that date. List contacts in order of preference; a web contact must use https.

ConfigurationPlain text

Contact: mailto:security@example.com
Contact: https://example.com/security/report
Expires: 2027-06-30T23:59:59Z
Encryption: https://example.com/security/pgp-key.txt
Policy: https://example.com/security/disclosure-policy
Acknowledgments: https://example.com/security/thanks
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt

To check what is served, fetch it with curl and paste the body here; the headers show the Content-Type. A signed file is checked for its OpenPGP structure only: verify the signature with gpg against a key you already trust.

Shell

curl -sS -D - https://example.com/.well-known/security.txt

What is checked

Contact: present, at least once, each a URI (mailto:, tel: or https:), in order of preference
Expires: present exactly once, an RFC 3339 date-time, not in the past and under a year ahead
Preferred-Languages: at most once, with comma-separated language tags
Encryption, Policy, Acknowledgments, Hiring, Canonical and CSAF: URIs, with https for every web URI
Lines that are neither fields nor comments, field names outside the IANA registry and their spelling
An OpenPGP cleartext signature: its structure, and a Canonical field to go with it
Where the file is served from, when you give the address: https and /.well-known/security.txt

Source specifications

Guides and practice

All tools

Guide

Run coordinated vulnerability disclosure from report to advisory

Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.

Guide

Start with a VDP, then add bug bounties and penetration tests

Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.

Guide

Set up a PSIRT: services, intake, triage, SLAs and the CNA role

How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.

security.txt validator

Validate a security.txt file

File report

A file that passes

What is checked

Source specifications

Guides and practice

Run coordinated vulnerability disclosure from report to advisory

Start with a VDP, then add bug bounties and penetration tests

Set up a PSIRT: services, intake, triage, SLAs and the CNA role

Find your next answer