Category: Developer tools
security.txt Generator
Generate a security.txt file for vulnerability disclosure
Fill in a security contact, expiry date, disclosure policy, acknowledgments page and preferred languages, and get a ready-to-publish security.txt file in the RFC 9116 format. Built locally in your browser.
Contact: mailto:security@example.com Preferred-Languages: en
Everything on this page is processed in your browser. Nothing is uploaded.
What this tool does
security.txt is a standardized file that tells security researchers how to report a vulnerability, instead of leaving them to guess an email address or dig through a contact page. Published at /.well-known/security.txt (or the site root), it needs at minimum a Contact field and an Expires date so scanners can tell a stale file from a maintained one. This tool fills in the RFC 9116 fields for you and formats them correctly.
How to use it
- Add one or more contact methods, one per line (mailto: or https: links work).
- Set an expiry date — required by the spec, so scanners can tell the file is still maintained.
- Optionally add a canonical URL, disclosure policy, acknowledgments page and preferred languages.
- Publish the result at /.well-known/security.txt on your domain.
Privacy
This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.
Frequently asked questions
- Where exactly does this file go?
- At /.well-known/security.txt is the location defined by the spec; some sites also serve a copy at the plain /security.txt root path for older clients.
- Why is Expires required?
- Without an expiry date, a scanner can't tell whether the file is current or was abandoned years ago with a now-dead contact address. RFC 9116 requires it for that reason.
- What goes in the Acknowledgments field?
- A URL to a page that credits researchers who've responsibly disclosed vulnerabilities in the past — it signals that reports are taken seriously and rewarded with recognition.