Free tool · no signup
security.txt generator
Make the file that tells security researchers how to report a bug to you. Fill in a contact and an expiry date, copy the result and publish it. Everything is built in your browser.
By the Bug Circuit security team · Last updated
Your details
- Add at least one Contact (an email, a web form URL or a phone number). It is the one field that makes the file useful.
Add a contact and an expiry date.- A Policy link (your disclosure rules and safe-harbour promise) tells researchers what is in scope and that you will not take legal action against good-faith reports.
Save this as security.txt and serve it at https://yourcompany.com/.well-known/security.txt over https, as plain text.
/.well-known/security.txt that says who to contact when someone finds a vulnerability on your site. It needs at least a Contact line and an Expires date. Without it, a researcher who finds a bug may not know how to tell you, or may post it publicly instead.How it works
What security.txt is
security.txt is an internet standard, RFC 9116, published in 2022. It is a plain text file with a few labelled lines. Researchers, bug bounty hunters and some scanners look for it first when they want to report a problem, the same way people look for a contact page.
The two required fields are Contact (where to send reports: an email address, a web form or a phone number) and Expires (the date after which the file should not be trusted). Everything else is optional: a Policy link with your disclosure rules, an Encryption key for private reports, an Acknowledgments page that thanks people, preferred languages, a Canonical address and a Hiring link.
Where the file has to live
Serve it over https at /.well-known/security.txt on your main domain, as plain text (Content-Type text/plain; charset=utf-8). The older location /security.txt is allowed as a fallback, but the .well-known path is the one tools check first.
Put a reminder in your calendar for a month before the Expires date. An expired file is treated as stale and some tools will ignore it, which is worse than having none because it looks abandoned. The generator defaults to an expiry about ten months away so you review it once a year.
What to put in each field
Use a mailbox that several people can read, such as security@yourcompany.com, so a report is not lost when one person is away. Add a Policy page that says what is in scope and promises not to take legal action against people who report in good faith, because researchers are more willing to write to you when that is clear.
A security.txt does not stop attacks. It makes sure the person who finds the problem first can reach you quietly. Pair it with a regular manual test, which is how Bug Circuit finds issues before anyone else does.
Worked examples
A small business with one mailbox
Contact: security@yourcompany.com. Expires: 30 June 2027.
Contact: mailto:security@yourcompany.com Expires: 2027-06-30T23:59:59.000Z
The smallest valid file. The tool adds the mailto: prefix and writes the date in the format the standard requires.
With a policy and a canonical address
Contact: security@yourcompany.com and a web form. Policy page. Languages: en.
Contact: mailto:security@yourcompany.com Contact: https://yourcompany.com/report Expires: 2027-06-30T23:59:59.000Z Preferred-Languages: en Canonical: https://yourcompany.com/.well-known/security.txt Policy: https://yourcompany.com/security-policy
Two ways to reach you, a link to your rules, and the canonical address so a copy of the file cannot be passed off as yours.
Frequently asked questions
Is a security.txt file required?
What happens when the Expires date passes?
Does security.txt make my site more secure?
Do I need to sign the file with PGP?
Where do I upload it?
Can I use a contact form instead of an email address?
Keep reading
See what attackers see, for free
Run the free passive check on your website. No login, no impact on your site, results in seconds.
Ready for the full manual audit? See pricing