security.txt: tell people where to report bugs
When someone finds a hole in your site, they need a way to tell you. A two-line file makes that easy.
Every few months someone emails info@ or messages a random employee on LinkedIn: “I found a security problem on your website.” Sometimes it’s a scam. Often it’s real, and the message sits unread.
A security.txt file tells researchers where to send reports. It lives at /.well-known/security.txt and can be as short as:
Contact: mailto:security@example.com
Expires: 2027-03-31T00:00:00ZA few things make it work:
- Use an address that a real person reads, and reply within a few days, even just to say thanks.
- Add a short page that says what you consider in scope and that you won’t take legal action against good-faith reports.
- Update the Expires date every year. A stale file looks abandoned.
You don’t need a bug bounty programme to start. You need a door that someone answers.