SEC-052
No security.txt for reporting vulnerabilities
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Whether /.well-known/security.txt (or the older /security.txt) is a plain-text file with a Contact line (RFC 9116).
Why it matters
Someone who finds a security hole has no published way to tell you, so the report goes nowhere, or goes public first.
Recommended fix
Publish /.well-known/security.txt with a Contact line (an email address or a form URL) and an Expires date.
How to verify
Open /.well-known/security.txt on the live site and confirm it returns plain text with a Contact line.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-052: No security.txt for reporting vulnerabilities
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a plain-text file served at /.well-known/security.txt that follows RFC 9116: `Contact: mailto:<our security address>` and `Expires: <a date within the next year>`, optionally `Policy:` linking to our disclosure policy. It must be public and must not redirect to an HTML page.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Open /.well-known/security.txt on the live site and confirm it returns plain text with a Contact line.