--- title: "Tell people how to report a hole ยท Agent Wranglers" url: https://agentwranglers.se/playbook/website/standard-addresses/security-txt id: WEB-143 level: Recommended updated: 2026-10-22 build: a2a6bdfed830 tokens: 981 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Tell people how to report a hole For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. - ID: WEB-143 - Level: Recommended - Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md) - Rule: Publish `/.well-known/security.txt` with a contact and an `Expires` date in the future. It tells people where to report security problems. - Check: `curl -sI https://example.com/.well-known/security.txt` answers 200 with `text/plain; charset=utf-8`. A test parses `Expires:` and fails when it is in the past or more than a year ahead. It also fails when any `Contact:` uses a reserved domain (`example.com`, `example.org`, `example.net`, `*.example`, `*.test`, `*.invalid`). Every quarter, a test message sent to each `Contact:` gets a reply from a person within the time the policy promises. - How: Serve the file as RFC 9116 describes, with `Contact:` and `Expires:` (both required), plus `Canonical:`, `Policy:` and `Preferred-Languages:`. Keep `Expires:` under a year ahead, and generate it at build time so it never lapses. Answer reports within the time your policy promises. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Plain text example ```text Contact: mailto:security@example.com Expires: 2027-06-30T00:00:00.000Z Canonical: https://example.com/.well-known/security.txt Policy: https://example.com/security-policy Preferred-Languages: en ``` ## Sources - [RFC 9116: A File Format to Aid in Security Vulnerability Disclosure](https://www.rfc-editor.org/rfc/rfc9116) ## Related rules - WEB-168 [Serve standard files at fixed addresses](https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview.md) in Website - EML-36 [Accept mail at postmaster and abuse](https://agentwranglers.se/playbook/email/inbound-mail-and-replies/postmaster-abuse.md) in Email - CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) in Compliance and governance - CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) in Compliance and governance - CMP-73 [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) in Compliance and governance - IOT-38 [Publish how to report a vulnerability in your device](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/device-disclosure-policy.md) in Connected devices - OSS-47 [Publish a security policy with the code](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md) in Open source maintenance - APS-107 [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers website playbook`. In code you write, add a comment next to it with the same link. - Previous: [Open links in your phone apps](https://agentwranglers.se/playbook/website/standard-addresses/app-links.md) - [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md)