---
title: "Tell people how to report a hole · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/security-txt
updated: 2026-10-20
licence: "All rights reserved"
---

# Tell people how to report a hole

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Publish `/.well-known/security.txt` with a contact and an `Expires` date in the future. It tells people where to report security problems.
- How: Serve the file as RFC 9116 describes, with `Contact:` and `Expires:` (both required), plus `Canonical:`, `Policy:` and `Preferred-Languages:`. Keep `Expires:` under a year ahead, and generate it at build time so it never lapses. Answer reports within the time your policy promises.
- Check: `curl -sI https://example.com/.well-known/security.txt` answers 200 with `text/plain; charset=utf-8`. A test parses `Expires:` and fails when it is in the past or more than a year ahead.

Example:

```text
Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00.000Z
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Preferred-Languages: en
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/security-txt`.

- Previous: [Collect reports of blocked content](https://agentwranglers.se/playbook/website/security/reporting-endpoints)
- Next: [Stop browsers guessing file types](https://agentwranglers.se/playbook/website/security/x-content-type-options)
- [Security](https://agentwranglers.se/playbook/website/security)