Security.txt
In cybersecurity, security.txt is a standardized, machine-readable text file that organizations host on their web servers to provide independent security researchers with explicit instructions for responsibly reporting vulnerabilities they discover. Formalized by the Internet Engineering Task Force (IETF) as RFC 9116, this file is traditionally located in a website's .well-known directory (for example, https://example.com/.well-known/security.txt).
Before the adoption of this standard, ethical hackers and bug bounty hunters frequently struggled to find the appropriate point of contact for reporting critical security flaws. This friction often resulted in delayed remediation, or in researchers publicly disclosing vulnerabilities because they could not securely reach the internal security team. The security.txt file solves this by standardizing the vulnerability disclosure process across the global internet.
Core Components of a SECURITY.TXT File
According to RFC 9116, a compliant security.txt file contains specific directives that guide the disclosure process.
Contact: The most critical required field, which defines exactly how a researcher should submit a vulnerability report. This must use a valid URI scheme, such as an email address (e.g., mailto:security@example.com) or a link to a secure web form.
Expires: A required field indicating the exact date and time at which the file's contents should be considered stale. This forces organizations to review and update their contact information periodically.
Encryption: An essential field that provides a link to a public cryptographic key (such as an OpenPGP key). This ensures researchers can encrypt sensitive vulnerability reports, preventing threat actors from intercepting exploit details in transit.
Policy: A link to the organization's official Vulnerability Disclosure Policy (VDP). This document outlines the rules of engagement, defining what assets are in scope for testing and what actions researchers are prohibited from taking.
Acknowledgments: A link to a public hall of fame where the organization publicly recognizes and thanks security researchers for their ethical contributions.
Canonical: The official URL where the security.txt file is hosted. This is highly recommended when the file is digitally signed, as it allows researchers to authenticate the document's origin.
The Importance of SECURITY.TXT
Implementing a security.txt file is a foundational step in proactive cyber defense and external attack surface management.
Accelerated Remediation: By providing a direct, verified channel to the security operations center, organizations eliminate helpdesk intermediaries, ensuring that critical zero-day vulnerabilities reach the engineering team instantly.
Reduced Public Exposure: When researchers have a clear, responsive channel for ethical disclosure, they are far less likely to post details of technical exploits on social media or public developer forums.
Demonstrated Security Maturity: Publishing a well-maintained security.txt file signals to customers, partners, and regulators that the organization embraces transparency and actively cooperates with the global cybersecurity community.
Frequently Asked Questions (FAQs)
Where should the security.txt file be located?
To comply with RFC 9116, the file must be served over a secure HTTPS connection and placed in the /.well-known/ directory at the root of the domain (e.g., https://www.example.com/.well-known/security.txt).
Is a security.txt file required by law?
While it is not universally required by international law, many regulatory bodies and government agencies mandate its use. For example, the Cybersecurity and Infrastructure Security Agency (CISA) requires all U.S. federal civilian executive branch agencies to publish and maintain a security.txt file.
Can an attacker abuse a security.txt file?
The file itself is purely informational and contains no executable code, meaning it cannot be hacked. However, if the file is not digitally signed or an attacker compromises the web server, they could alter the Contact or Encryption fields to intercept incoming vulnerability reports, highlighting the need to monitor the file for unauthorized changes.
Managing Vulnerability Disclosures and SECURITY.TXT Using ThreatNG
Because security.txt serves as the primary bridge between an organization and external researchers, ensuring its proper deployment and configuration across a massive enterprise perimeter is a critical operational requirement. If a subsidiary deploys an unmanaged web application without this file, or if an existing file contains an expired PGP key, the organization loses the ability to receive critical vulnerability intelligence.
ThreatNG operates as an advanced, connectorless, agentless Integrated External Risk Management Platform. By providing an attacker's perspective without performing penetration testing, ThreatNG continuously maps an organization's external digital presence. This comprehensive outside-in visibility helps security teams identify, audit, and secure the infrastructure supporting their vulnerability disclosure programs.
Agentless External Discovery to Locate SECURITY.TXT Deployments
A massive enterprise often manages thousands of active domains, marketing microsites, and cloud-hosted applications. If the central security team does not know an application exists, they cannot ensure it hosts a valid security.txt file.
ThreatNG executes connectorless, agentless external discovery across the global internet to compile a definitive digital footprint of an enterprise. Operating entirely from the outside-in without requiring internal software agents, the discovery engine recursively uncovers all registered domain names, subdomains, and active web applications associated with the corporate brand. During this discovery phase, ThreatNG automatically scans the /.well-known/ directory of every identified asset, cataloging which websites have successfully deployed a security.txt file and which legacy portals or shadow IT environments are missing this essential disclosure mechanism.
Deep External Assessment to Audit RFC 9116 Compliance
Simply having a security.txt file is not enough; its contents must be accurate, secure, and fully compliant with the IETF standard. ThreatNG performs non-intrusive, deep external assessments to parse the exact contents of discovered disclosure files.
Detailed Assessment Example: Validating Expiration and Encryption Fields
During an external assessment of a corporate web portal, ThreatNG actively parses the security.txt file. The assessment engine might detect that the date in the Expires field has passed, rendering the file non-compliant and technically stale. Additionally, ThreatNG checks the linked Encryption key. If the platform determines that the linked public PGP key uses a weak cryptographic algorithm or has been revoked, it flags the file as a high-severity exposure. This technical intelligence warns the security team that researchers might be submitting encrypted vulnerability reports that the internal team can no longer decrypt, allowing administrators to update the key immediately.
Detailed Assessment Example: Digital Signature Verification
To prevent threat actors from silently modifying the file to hijack vulnerability reports, best practices dictate that the security.txt file should be digitally signed. ThreatNG assesses the file for an active OpenPGP cleartext signature and cross-references it against the Canonical URI field. If the signature is missing or fails validation, ThreatNG highlights the exact discrepancy, providing infrastructure teams with the precise evidence needed to re-sign the file and restore trust in the disclosure channel.
Deep-Dive Investigation Modules for Off-Perimeter Risk Context
ThreatNG deploys highly specialized investigation modules to track external risks across the open, deep, and dark web. These modules generate the exact type of intelligence that a robust vulnerability disclosure program seeks to manage.
Detailed Investigation Example: Sensitive Code Exposure Module
Ethical researchers often use security.txt to report data leaks. ThreatNG automates the discovery of these leaks through its Sensitive Code Exposure module, which continuously scans public development environments such as GitHub and GitLab. In a live scenario, the module might discover a public code repository containing hardcoded cloud API keys or plaintext credentials. ThreatNG captures the exact repository URL and the exposed secrets in real time. This immediate discovery allows the organization to remediate the exposure internally before an external researcher even submits a report, reducing administrative overhead.
Detailed Investigation Example: Dark Web and Infostealer Intelligence Module
When an organization's disclosure policy fails, vulnerabilities and stolen credentials end up on underground forums. Driven by the DarCache Infostealer Intelligence Repository, ThreatNG’s Dark Web Presence module continuously sanitizes and monitors ransomware leak logs and illicit paste bins. If an Initial Access Broker posts an infostealer log containing active corporate credentials or Primary Refresh Tokens, ThreatNG intercepts the data. The module uses a patent-backed Context Engine™ to deliver precise attribution, allowing the organization to execute emergency identity protections and lock down compromised accounts before they are used to breach the network.
Continuous Monitoring to Stop Configuration Drift
Web architectures are highly dynamic; developers push updates, migrate servers, and rewrite routing rules daily. A security.txt file that is perfectly configured on a Monday can be accidentally overwritten or deleted during a Wednesday server migration.
ThreatNG provides continuous monitoring across the entire external attack surface. The moment a web update accidentally strips a security.txt file from a production server, or an administrator inadvertently breaks the HTTPS configuration required to serve the file securely, ThreatNG identifies the configuration drift in real time. This zero-latency tracking ensures that the organization's vulnerability disclosure channels remain permanently open and compliant.
Intelligence Repositories for Strategic Attack Path Context
ThreatNG aggregates all discovered external assets, missing security.txt files, and technical vulnerabilities within DarCache, its centralized operational intelligence data store. DarCache fuses this external footprint data with known threat intelligence catalogs.
To turn these data points into a cohesive defensive strategy, ThreatNG uses the DarChain engine to perform contextual hyper-analysis of digital attack risk. DarChain models the exact path an adversary would take, demonstrating how a missing security.txt file contributes to a broader systemic failure. By chaining together separate, lower-severity vulnerabilities—such as an unmanaged staging server that lacks a disclosure file, combined with a missing security header and a leaked API token found via the Sensitive Code Exposure module—DarChain illustrates exactly how an attacker could compromise the network before a researcher has the chance to report the flaw.
Standardized Reporting for Disclosure Governance
ThreatNG translates its continuous external findings into the eXposure paradigm, generating structured Executive, Technical, and Prioritized reports. Executive Reports convert complex compliance metrics (such as the percentage of corporate domains properly hosting a security.txt file) into clear Security Ratings, helping leadership track digital risk and regulatory adherence. Concurrently, Technical and Prioritized Reports deliver actionable data directly to engineering queues. These documents feature an embedded Knowledgebase complete with technical definitions, RFC 9116 syntax rules, and precise, step-by-step remediation instructions, ensuring infrastructure teams can generate and deploy compliant files immediately.
Automating Defenses Through Cooperation with Complementary Solutions
ThreatNG functions as an automated external intelligence engine, focusing on seamless cooperation with complementary internal security solutions to accelerate vulnerability remediation.
Cooperation with Vulnerability Management Complementary Solutions: Traditional internal scanners often struggle to track non-standard web files, such as security.txt. ThreatNG cooperates with these systems by continuously feeding its externally discovered asset list and security.txt compliance statuses directly into the central vulnerability management database. This cooperation ensures that the absence of a disclosure file is tracked, scored, and prioritized exactly like a missing software patch.
Cooperation with Threat Intelligence Platform (TIP) Complementary Solutions: When ThreatNG’s Dark Web module discovers active corporate session tokens or leaked credentials on underground forums, it routes this technical intelligence to enterprise TIP complementary solutions. The TIP cooperates by correlating these external threat indicators with internal network telemetry, providing analysts with a unified view of whether an active attack is underway based on the compromised data.
Cooperation with Security Orchestration, Automation, and Response (SOAR) Complementary Solutions: Upon identifying that the PGP encryption key for a critical security.txt file has expired across multiple corporate domains, ThreatNG sends a zero-latency signal to enterprise SOAR complementary solutions. The SOAR platform cooperates by automatically executing a predefined compliance playbook that generates a high-priority ticket for the cryptography team, tracks the deployment of the new public key, and alerts the web administration team to update the .well-known directories across the affected servers.
