“The main purpose of security.txt is to help make things easier for companies and security researchers when trying to secure platforms. Thanks to security.txt, security researchers can easily get in touch with companies about security issues.”

source: [securitytxt.org...]

The security.txt file should be placed in the /.well-known/ directory. If you cannot use this directory, use the base level directory.


Example of security.txt content:

Contact: mailto:example@example.com

Contact: tel:+1-###-###-####

Contact: https://www.example.com/contact.html

Encryption: https://www.example.com/pgp-key.txt*

Policy: https://www.example.com/policy.html

*If you store your own Public Key, use that path. If it is stored remotely & is HTTP accessible, use that URI. If unknown, leave blank.

Other optional fields explained here. [securitytxt.org]

- - -