How it works
The file lives at https://example.com/.well-known/security.txt and describes how to report security issues. Two fields are required: Contact (a mailto:, tel: or https: URI) and Expires, an RFC 3339 date that the RFC says should be less than a year in the future.
Optional fields include Encryption (a public key), Policy (the rules for reports), Acknowledgments, Preferred-Languages, Hiring and Canonical (the URLs the file applies to). It is served as text/plain over HTTPS and may be signed with OpenPGP.
Once Expires has passed, researchers are supposed to ignore the file. That is where many files fail: created once, never touched again.
Why it matters
Without a security.txt, people who find a vulnerability dig through the legal notice, write to a generic address or give up. The report ends up in spam or with someone who can’t assess it, and the hole stays open until someone else exploits it.
An expired or broken file is hardly better: it signals that nobody is in charge and may route reports to addresses that no longer exist.
How to prevent it
- Create /.well-known/security.txt with at least Contact and Expires, for example Contact: mailto:security@example.com and Expires: 2027-06-30T23:00:00.000Z.
- Use a shared mailbox such as security@ that several people read rather than a personal address.
- Set Expires no more than a year ahead and schedule the renewal – or have the file served by a service that keeps Expires current automatically.
- Serve the file as text/plain over HTTPS, without a redirect to http://.
- Link a policy page that explains what to report and when to expect a reply.
How DomainWarn detects it
The security.txt check fetches /.well-known/security.txt daily (falling back to the legacy location /security.txt) and validates it against RFC 9116. A missing file is a notice. A missing Contact or Expires field, an unreadable date or delivery over plain HTTP opens the “security.txt invalid” incident; an expired file leads to “security.txt expired” and expiry within the next 30 days to “security.txt expiring soon”.
A wrong content type, the legacy location, unparseable lines, a duplicate Expires field, an expiry more than a year out and a mismatched Canonical value are notices. DomainWarn detects an OpenPGP signature but does not verify it. If you like, DomainWarn generates the file itself and keeps Expires up to date.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.