Security Recommended

Tell people how to report a hole

Publish /.well-known/security.txt with a contact and an Expires date in the future. It tells people where to report security problems.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Serve the file as RFC 9116 describes, with Contact: and Expires: (both required), plus Canonical:, Policy: and Preferred-Languages:. Keep Expires: under a year ahead, and generate it at build time so it never lapses. Answer reports within the time your policy promises.

Example

Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00.000Z
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Preferred-Languages: en

How to check

curl -sI https://example.com/.well-known/security.txt answers 200 with text/plain; charset=utf-8. A test parses Expires: and fails when it is in the past or more than a year ahead.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/security-txt.