Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Publish a UTF-8 plain-text file at https://your-domain/.well-known/security.txt for every domain or IP address that needs a vulnerability-reporting route. RFC 9116 makes Contact and Expires mandatory; the first tells researchers where to report, while the second prevents indefinite reliance on stale details. The EU Cyber Resilience Act (CRA) does not name security.txt, but it requires manufacturers of products with digital elements to operate coordinated vulnerability disclosure and a reporting contact. A correctly scoped, maintained file is therefore a practical way to meet that access requirement—not a substitute for the CRA’s internal triage, remediation, user-notification and regulator-reporting duties.
What is security.txt, and why are EU software makers publishing it now?
security.txt is a machine-readable contact file for security researchers. RFC 9116, published by the IETF in 2022, defines it as a way to help researchers disclose vulnerabilities to the right organization instead of guessing at an email address or support form.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The file is deliberately small. It does not describe a product’s complete security architecture, certify compliance, or replace a vulnerability-disclosure policy. It provides a dependable starting point: a reporting channel, an expiration date, and optionally links to policy, encryption keys, acknowledgments and language information.
The CRA, Regulation (EU) 2024/2847, creates the immediate reason for EU manufacturers to make that route reliable. It requires a coordinated vulnerability-disclosure policy, a contact address for reporting vulnerabilities, and a single point of contact where vulnerability information can be reported and the policy can be found. The regulation does not require a file named security.txt; using the RFC 9116 format is an implementation choice that makes the required contact easier for people and tools to find.
#1 Best Overall
Where does /.well-known/security.txt go?
For a web service, place the file at the exact HTTPS URL https://your-domain/.well-known/security.txt. The server should return it as UTF-8 text/plain. The path is part of the standard: placing a file only at a convenient support URL does not provide the well-known location that automated clients will request.
HTTP requirements
- Scheme: serve the file over HTTPS.
- Path: use
/.well-known/security.txt. - Media type: return
Content-Type: text/plain. - Encoding: save the bytes as UTF-8.
- Format: put one field on each line using the RFC field names.
A top-level /security.txt can redirect for compatibility with older tooling, but the /.well-known/ copy takes precedence when both exist. Treat the well-known file as the authoritative copy and keep any redirect target under your control.
What is the scope of a security.txt file?
Scope is limited to the exact domain or IP address used to retrieve the file. A file fetched from https://example.eu/.well-known/security.txt describes that host; it does not automatically cover www.example.eu, api.example.eu, a parent domain, or a separate product domain.
Create and maintain a file for every host that needs its own reporting route. If several hosts share one security team, each file can point to the same monitored channel, but each host still needs to publish the route at its own well-known URL. Review regional domains, customer portals, API endpoints and legacy product domains rather than assuming DNS or organizational ownership creates inheritance.
Which fields are mandatory in RFC 9116?
Only two fields are required for a usable file: Contact and Expires. Optional fields make the process easier to authenticate, understand and operate.
| Field | Required? | Purpose and valid use |
|---|---|---|
Contact |
Yes | Identifies the reporting channel. Use a mailto:, tel: or HTTPS URI. You may list multiple contacts in preference order. |
Expires |
Yes; exactly one | States when the file must be considered stale. Use an RFC-compatible date-time such as 2027-10-26T00:00:00z and renew it before that time. |
Canonical |
No | Identifies the intended, authoritative location of the file. |
Encryption |
No | Links to a public key, commonly an OpenPGP key, that researchers can use to protect sensitive reports. |
Policy |
No | Links to the vulnerability-disclosure policy covering scope, safe-harbor terms, report expectations and response handling. |
Preferred-Languages |
No | Lists languages the receiving team can handle, for example en, de. |
Acknowledgments |
No | Links to a page recognizing researchers who have made responsible disclosures. |
Field names are case-insensitive in the RFC format, but using the conventional capitalization improves readability. Do not put two different expiration dates in the same file: Expires is a single required field.
Rank #2
How do I create a security.txt file?
Use this sequence to create a file that researchers can actually reach and your team can operate.
- Inventory the scope. List every public domain and IP address for which your organization accepts vulnerability reports. Decide whether product, regional and API hosts need separate files.
- Choose a staffed channel. Select a monitored security mailbox or a managed HTTPS reporting portal. Confirm who watches it, who can act on urgent reports and what happens outside local business hours.
- Write the minimum file. Start with a reachable
ContactURI and one futureExpiresvalue. A mailbox is useful only if it is monitored and protected from silent forwarding or account expiry. - Add the policy link. Publish a vulnerability-disclosure policy explaining in-scope assets, safe-harbor terms, information a report should contain and how your team acknowledges and handles submissions.
- Add trust and language details where you can operate them. A
CanonicalURL removes ambiguity. AnEncryptionURL can point to an OpenPGP public key, but only publish a key that you can rotate, revoke and monitor safely. - Save as UTF-8 plain text. Do not generate an HTML page that merely looks like text. Ensure every field occupies its own line and that the response does not add a character encoding that conflicts with UTF-8.
- Deploy at the well-known path. Publish the file at
https://your-domain/.well-known/security.txt. If you retain/security.txt, redirect it to the well-known location. - Test from outside your network. Fetch the HTTPS URL without authentication and verify the status, content type, encoding, redirects, line breaks and contact reachability.
- Connect intake to operations. Route submissions into triage, ticketing, remediation, release management and the CRA escalation process. A public file without an owner merely directs researchers into a dead end.
What should a complete file look like?
This example includes the optional fields while keeping the required values explicit. Replace every example host, mailbox, key and policy URL with resources your organization controls.
Canonical: https://example.eu/.well-known/security.txt
Contact: mailto:[email protected]
Encryption: https://example.eu/.well-known/pgp-key.txt
Policy: https://example.eu/security-policy
Preferred-Languages: en, de
Acknowledgments: https://example.eu/security-acknowledgments
Expires: 2027-10-26T00:00:00zThe smallest practical version is:
Contact: mailto:[email protected]
Expires: 2027-10-26T00:00:00zUse mailto: when email is genuinely monitored, tel: when a staffed telephone route is appropriate, or an HTTPS URI for a portal that accepts reports without forcing researchers through a general support queue. Multiple Contact lines can express a preferred order, but every listed route should be operational.
How should organizations maintain and secure the file?
Maintenance is part of the security function, not a one-time web edit. RFC 9116 warns that a compromised site could alter the file or redirect reports. Keep the file, its referenced pages, encryption keys and contact addresses under organizational control.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Control expiry
Set an Expires value that your team can renew before it passes. Add the date to an owned monitoring system, alert the responsible team in advance and test the renewal procedure. An expired file can leave researchers relying on an address that has been abandoned or reassigned.
Protect references
Check that the Canonical, Policy, Encryption and Acknowledgments URLs still resolve over HTTPS and have not been redirected to an unrelated host. If you rotate a key, publish the replacement before removing the old one and update the file in the same controlled change.
Monitor the reporting route
Send test messages to the mailbox or portal, confirm that the right queue receives them and verify that permissions allow the security team to read and respond. Include contact checks in employee off-boarding, domain transfers and mailbox migrations so a staffing change does not silently break the route.
Consider signing the file
A Canonical field and an OpenPGP cleartext signature can help researchers verify that they obtained the intended content. Signing adds key-management work; use it only if your organization can protect the signing key, publish the verification material and handle rotation and revocation consistently.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does the Cyber Resilience Act require a security.txt file?
No. The CRA does not name the filename, path or RFC 9116. It requires manufacturers of products with digital elements to establish and enforce coordinated vulnerability disclosure, provide a contact address, and maintain a single point of contact where vulnerability information and the policy can be found.
Publishing a correctly scoped security.txt is a practical implementation of that public contact requirement because it gives researchers a predictable, machine-readable location. It does not by itself demonstrate that the manufacturer has a coordinated-disclosure policy, staffed triage, remediation controls, security-update processes or the ability to make required regulatory notifications.
The CRA also requires manufacturers to identify and document vulnerabilities, remediate them without delay, test and review product security, disclose information about fixed vulnerabilities subject to justified security exceptions, and provide security updates during the support period. Treat the file as the front door to that program, not as the program itself.
What are the CRA vulnerability-reporting deadlines?
For an actively exploited vulnerability, Article 14 sets a staged reporting timetable. The clock starts when the manufacturer becomes aware, and notifications go simultaneously to the designated coordinating CSIRT and ENISA through the single reporting platform.
Rank #4
| Stage | Deadline | Operational implication |
|---|---|---|
| Early warning | Without undue delay and no later than 24 hours after awareness | Maintain an escalation path that can identify active exploitation and authorize an immediate notification. |
| Vulnerability notification | Within 72 hours | Move from initial awareness to a fuller notification while technical investigation and containment continue. |
| Final report | No later than 14 days after a corrective or mitigating measure is available | Track the point at which a fix or mitigation becomes available and trigger the final-report workflow. |
These regulatory deadlines are separate from the response promise you publish to researchers. Your disclosure policy can describe acknowledgment and update practices, while the CRA workflow must preserve evidence, coordinate remediation and meet the statutory notification stages.
Which implementation choices should an EU maker make?
There is no single deployment pattern for every product portfolio. Choose the option that your team can operate continuously, then document ownership and escalation.
| Decision area | Option A | Option B | Choosing factor |
|---|---|---|---|
| Reporting channel | Monitored security mailbox | Managed HTTPS portal | Use the mailbox when trained staff can protect and monitor it; use a portal when structured intake, access control and case tracking are essential. |
| Trust controls | Unsigned file | Canonical field plus OpenPGP signature | Add signing only when key custody, rotation and verification can be maintained reliably. |
| Scope management | One domain | Multiple product and regional domains | Publish per host; shared contacts are acceptable when ownership and routing remain clear. |
| Operational integration | Standalone intake | Integrated triage, ticketing, remediation and CRA reporting | Integration reduces the chance that a report is received but not escalated or tracked. |
| Maintenance discipline | Manual renewal | Monitored expiry and contact checks | Automated alerts and recurring tests are safer for organizations with many hosts or staff changes. |
What commonly goes wrong, and how can it be fixed?
The file is at the wrong URL
Symptom: /security.txt works, but /.well-known/security.txt returns a 404. Fix: publish the well-known path and keep the top-level location only as a compatibility redirect.
The response is HTML or has the wrong content type
Symptom: a CMS renders a styled page, or the server sends text/html. Fix: serve the raw UTF-8 file with Content-Type: text/plain and verify the response headers from an external network.
Recommended Free Tools
The contact is not monitored
Symptom: messages bounce, enter an unattended inbox or reach general customer support. Fix: assign an owner, test delivery, configure backups and connect the route to an on-call or escalation process.
The expiration date has passed
Symptom: the file still loads but its Expires value is in the past. Fix: renew it before expiry through a controlled change and add monitoring so the next renewal is not manual guesswork.
One file is assumed to cover every host
Symptom: researchers report an API or regional domain using the parent domain’s file, but the receiving team does not own that queue. Fix: publish a file at each in-scope host and map each contact to the team responsible for that product.
The public route is disconnected from CRA reporting
Symptom: the security team receives a report but cannot identify who decides whether exploitation is active or who files the 24-hour, 72-hour and final notifications. Fix: define internal severity, legal and incident-response handoffs before publishing the address.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What is the final launch checklist?
- Every required domain and IP address has its own well-known file.
- The URL loads over HTTPS without authentication.
- The response is UTF-8
text/plain, with one field per line. Contactreaches a monitored mailbox, telephone route or portal.- Exactly one current
Expiresfield is present and renewal is monitored. Canonical, policy, key and acknowledgment links resolve and remain under organizational control.- The disclosure policy explains scope, safe harbor, report details and response handling.
- Researchers can submit reports in the listed preferred languages, or the policy clearly states the supported languages.
- Mailbox or portal intake is connected to triage, ticketing, remediation and release processes.
- The CRA escalation path identifies the coordinating CSIRT and ENISA reporting responsibilities and preserves the 24-hour, 72-hour and 14-day milestones.
- After deployment, an independent test confirms the URL, headers, redirects, contact route and expiry monitoring.
For EU software makers, the practical decision is straightforward: publish security.txt wherever researchers need a reporting route, keep it accurate and monitored, and use it as the discoverable entry point to a broader coordinated-disclosure and CRA compliance process.
Frequently Asked Questions
How far in advance should the Expires date be set?
RFC 9116 requires a future expiration but does not prescribe a universal renewal interval. Choose a period your organization can monitor and renew reliably, then alert the owner before the date arrives rather than treating renewal as an occasional web edit.
Can a security.txt file replace our vulnerability-disclosure policy?
No. The file can point to the policy, but it cannot explain your scope, safe-harbor terms, report expectations, response handling or escalation rules in a dependable operational format. Keep those details in the linked policy and keep the link current.
What should happen when a report arrives outside business hours?
Your published contact should feed an owned process with an on-call or escalation decision for urgent cases. The CRA’s active-exploitation timeline makes it important to know who can recognize awareness and start regulatory notification work without waiting for the next business day.
Do all contacts listed in security.txt need to stay active?
Yes. Listing an address that is not monitored creates a false route and can delay disclosure. Remove retired addresses, test the remaining channels periodically and update the file when staffing, domains or reporting systems change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
