Free tool · no account needed

security.txt generator

Tell security researchers how to reach you: a security.txt file for your website, and a draft disclosure policy to link from it.

The asks manufacturers to provide a contact address for reporting vulnerabilities and to have a (Regulation (EU) 2024/2847, Annex I, Part II, points 5 and 6). A file, defined by RFC 9116, is the standard place researchers look for that contact.

Fill in the form and the file builds as you type. The second tab drafts a disclosure policy from the same answers for you to edit and publish.

Everything is made here, in this browser tab. Nothing you type is sent anywhere. If you follow the sign-in link, the values you typed go with it in the address.

Contact

Where researchers send reports. At least one is required (email, phone or web page); the one you pick below goes first, and researchers try that one first. Use an address that a person reads, not a no-reply box.

(email)

A security mailbox, such as security@your-company.com. Written into the file as a mailto: link.

(phone)

A number with its country code, if someone can take security calls. Written into the file as a tel: link.

(web page)

A page or form for reports, if you have one.

List first:EmailPhoneWeb page

required

The date after which researchers should stop trusting this file. Set to one year from today; RFC 9116 recommends no further ahead.

Your vulnerability disclosure policy: how you handle reports. The second tab drafts one for you to publish at this address.

The address of your public key, so reports can be sent encrypted. A link to the key, not the key itself.

Languages you can read reports in, as codes separated by commas, such as en, de.

A page thanking people who reported issues to you, if you keep one.

The address this file itself is published at, one per line if it is served on more than one domain. It lets readers spot a copy that was moved somewhere else.

A page listing security jobs at your company, if you want researchers to see it.

Your file

Fill in a contact and the file appears here, line by line.

Want a reminder before it expires? Publish it from an account and Declarable emails you 30, 7 and 1 days before it expires, and once more after it has expired. Sign in to publish it

Reading the current legal state…

Where to put it

Publish the file at https://your-site/.well-known/security.txt, over HTTPS, served as text/plain; charset=utf-8. You may also redirect /security.txt to it for older tools. Put one on every domain researchers might look at, such as the one printed on your device or in its app. If the same file is served at more than one address, list each in the Canonical box, one per line.

Apache

Save the file as .well-known/security.txt under your document root, then add to .htaccess or the site config:

Redirect 301 /security.txt /.well-known/security.txt

To send the charset with it, add this too. ForceType sets the media type of the files a Files block matches, and both are allowed in .htaccess:

<Files "security.txt">
  ForceType "text/plain; charset=utf-8"
</Files>

nginx

Inside the site's server block, pointing at wherever you saved the file:

location = /.well-known/security.txt { default_type "text/plain; charset=utf-8"; alias /var/www/security.txt; }

Next.js

Save the file as public/.well-known/security.txt in your project. Next.js serves everything in public/ from the site root, so it appears at /.well-known/security.txt on the next deploy.

Signing it (optional)

RFC 9116 recommends signing the file with an cleartext signature, so readers can tell it has not been changed. With GnuPG, this writes the signed copy to security.txt.signed:

gpg --clearsign --output security.txt.signed security.txt

Publish that signed copy as security.txt: upload it to .well-known/security.txt under that name. RFC 9116 serves the signed text at the same address as the plain file.

Once its Expires date passes, RFC 9116 tells readers to treat the file as stale, so put that date in your calendar and publish a new file before it.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.