security.txt Checker
Verify a site's vulnerability-disclosure file (security.txt) exists and follows the RFC 9116 standard.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
security.txt is a standardized file (defined in RFC 9116) that tells security researchers exactly how to report a vulnerability they've found — a contact address, a PGP key, an expiry date — instead of them having to guess who to email.
Without it, researchers who find a real vulnerability in your site often either give up or post it publicly, since there's no clear, safe way to reach you first.
Frequently asked questions
Where exactly should a security.txt file live?
At the standardized path /.well-known/security.txt as defined in RFC 9116 — a copy at the domain root alone won't reliably be found by automated tools and researchers who check the well-known location first.
What happens if I don't have one?
Nothing breaks automatically, but security researchers who find a vulnerability have no standard way to reach you — they may struggle to report it responsibly, or go public without any incentive to notify you first.
Related tools