Free tools Windows power users keep installed
One-click scans. No signup required.
You can publish a basic security.txt file in about ten minutes if your organization already has a monitored security contact and an approved disclosure policy. The file helps security researchers find how to report vulnerabilities; it is not a vulnerability-handling program or, by itself, a Cyber Resilience Act (CRA) compliance measure.
What security.txt does
RFC 9116 defines security.txt as a machine-readable text file intended to help researchers disclose security vulnerabilities. It points to an organization’s reporting route and, where available, its disclosure policy. As the RFC puts it, “This file is intended to help security researchers when disclosing security vulnerabilities.” RFC 9116.
As an Amazon Associate I earn from qualifying purchases.
It does not receive, triage, investigate, fix, or report vulnerabilities for you. A contact address is useful only if someone monitors it and knows what to do with incoming reports.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsPublish a basic file
This walkthrough assumes your organization has already approved the contact details and policy it will publish. Do not invent an address, policy URL, scope, expiry date, or response commitment to fill out the file.
#1 Best Overall
- Choose the host the file covers. RFC 9116 scopes a file to the host from which it is retrieved. If separate subdomains or hosts need their own reporting details, publish a file for each relevant host.
- Choose a monitored contact route. Add a dedicated email address, phone number, or reporting page that your team actually handles. The RFC says the Contact field indicates a method researchers should use to report vulnerabilities. See RFC 9116, section 2.5.3.
- Link to your disclosure policy. If you have an approved policy, use the Policy field to explain matters such as in-scope systems and the reporting process. RFC 9116 recommends that organizations use this directive to provide further details.
- Set an expiry and assign an owner. An unsigned file requires exactly one Expires field under the RFC’s grammar. Choose a real future expiry value and assign someone to renew the file before it lapses.
- Publish at the standard location. Serve the file over HTTPS at
https://<domain>/.well-known/security.txt, using UTF-8 encoding and thetext/plainmedia type. The top-level legacy path may redirect; if both locations exist, use the well-known path. - Verify the live endpoint. Retrieve the published URL and check that it loads over HTTPS, returns plain text in UTF-8, contains the expected fields and expiry, and points to working destinations. This is a practical validation step, not a substitute for operating the reporting process.
A minimal illustrative shape is:
Contact: <your monitored reporting contact>
Expires: <valid future expiry date and time>
Policy: <your approved vulnerability disclosure policy URL>Replace every bracketed description with verified details before publishing; these are explanatory placeholders, not valid field values.
Does the CRA require security.txt?
The researched CRA text does not expressly require a security.txt file. It does require manufacturers to have coordinated vulnerability disclosure policies and procedures under Annex I, Part II. A file can help researchers discover that process, but publishing one does not establish that the policy and procedures meet the Act’s requirements. See the Cyber Resilience Act text.
The CRA applies generally from 11 December 2027. Chapter IV has applied since 11 June 2026, and Article 14 reporting obligations have applied since 11 September 2026. According to the European Commission’s CRA summary, products placed on the market before 11 December 2027 are generally subject to the CRA only if they undergo a substantial modification from that date. Product-specific applicability can depend on the facts, so check the operative regulation and current Commission implementation guidance.
Article 14 reporting is a separate process
Article 14 concerns manufacturers’ notifications of actively exploited vulnerabilities and severe incidents affecting product security. Notifications go through the single reporting platform to the CSIRT designated as coordinator for the Member State where the manufacturer has its main establishment in the EU; the notification is simultaneously accessible to ENISA. This statutory route is not the public contact address in security.txt.
| Event | Required sequence and deadlines |
|---|---|
| Actively exploited vulnerability | Early warning without undue delay and within 24 hours of awareness; vulnerability notification within 72 hours; final report within 14 days after the vulnerability notification. |
| Severe incident | Early warning within 24 hours; incident notification within 72 hours; final report within one month after the incident notification. |
These are distinct reporting tracks under Article 14 of the CRA, not a single general deadline. The Act also requires manufacturers, after becoming aware of an actively exploited vulnerability or severe incident, to inform impacted users and, where appropriate, all users, including relevant mitigation or corrective measures. Coordinating CSIRTs provide helpdesk support for Article 14 reporting, with particular attention to microenterprises and small and medium-sized enterprises.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a functioning process needs beyond the file
The useful test is not just whether the URL loads. The organization also needs clear ownership of the process that begins when a report arrives.
Rank #4
- A person or team monitors the published contact route and can acknowledge and route reports.
- A disclosure policy explains scope and how researchers should report issues.
- Someone owns triage, remediation coordination, escalation, and any required statutory reporting.
- The contact, policy, and expiry stay accurate as systems and responsibilities change.
- Public researcher contact is kept distinct from the CRA’s Article 14 reporting platform and deadlines.
The file is a quick discovery layer when those foundations already exist. Creating the policy, assigning responsibility, and building a vulnerability response capability are separate organizational work.
Quick Recap
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
