Agent WranglersWEB-143Recommended
Tell people how to report a hole
Publish /.well-known/security.txt with a contact and an Expires date in the future. It tells people where to report security problems.
How to do it
Serve the file as RFC 9116 describes, with Contact: and Expires: (both required), plus Canonical:, Policy: and Preferred-Languages:. Keep Expires: under a year ahead, and generate it at build time so it never lapses. Answer reports within the time your policy promises.
Examples
Plain text example
Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00.000Z
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Preferred-Languages: enHow to check
curl -sI https://example.com/.well-known/security.txt answers 200 with text/plain; charset=utf-8. A test parses Expires: and fails when it is in the past or more than a year ahead. It also fails when any Contact: uses a reserved domain (example.com, example.org, example.net, *.example, *.test, *.invalid). Every quarter, a test message sent to each Contact: gets a reply from a person within the time the policy promises.
Sources
Related rules
- WEB-168 Serve standard files at fixed addresses in Website
- EML-36 Accept mail at postmaster and abuse in Email
- CMP-49 Report exploited vulnerabilities in your products in Compliance and governance
- CMP-50 Handle vulnerabilities for the whole support period in Compliance and governance
- CMP-73 Publish an advisory for every fixed vulnerability in Compliance and governance
- IOT-38 Publish how to report a vulnerability in your device in Connected devices
- OSS-47 Publish a security policy with the code in Open source maintenance
- APS-107 Publish a vulnerability disclosure policy in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/website/standard-addresses/security-txt">Agent Wranglers website playbook</a>. In code you write, add a comment next to it with the same link.