security.txt

The site has a security.txt file so researchers know how to report issues.

Impact

About

security.txt is a text file located on the site root-level or /.well-known/ directory that helps improve vulnerability disclosure by giving security researchers clear contact and reporting information.

security.txt is an accepted standard (RFC 9116) by the Internet Engineering Task Force.

Risks

Security researchers cannot report problems to you.

Why it's important

Provides contact info for reporting security issues, helping site owners fix problems quickly and keep users safe.

User stories

As a security researcher, I want to find a security.txt file on the website so that I can report vulnerabilities to the right contact securely and efficiently.

Code

Place at /.well-known/security.txt:

Contact: mailto:security@agency.gov
Expires: 2026-12-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://agency.gov/.well-known/security.txt

Error

ScanGov messaging when a site fails a standard:

No available security.txt file.

Example

A complete security.txt file with all recommended fields:

# U.S. Department of Veterans Affairs — security.txt
# https://www.va.gov/.well-known/security.txt

Contact: mailto:security@va.gov
Expires: 2026-12-31T23:59:59.000Z
Encryption: https://www.va.gov/pgp-key.txt
Acknowledgments: https://www.va.gov/security/hall-of-fame/
Preferred-Languages: en
Canonical: https://www.va.gov/.well-known/security.txt
Policy: https://www.va.gov/security/vulnerability-disclosure-policy/
Hiring: https://www.va.gov/careers/

Guidance

Indicators

Security