security.txt in ten minutes
A security researcher finds a bug in your product. They want to tell you. Where do they send it?
If the answer is "good question," security.txt fixes that in ten minutes, no framework needed.
The three lines
RFC 9116 defines a plain text file at /.well-known/security.txt. Three fields cover the basics.
- Contact: how to reach you, an email or a URL.
- Expires: a date. Past that date, scanners treat the file as stale.
- Canonical: the URL of this exact file, so a mirror or a CDN copy doesn't get mistaken for the source.
Contact: mailto:security@example.com
Expires: 2027-01-01T00:00:00Z
Canonical: https://example.com/.well-known/security.txt
Drop it in your static assets, deploy, done. No build step, no dependency.
What Annex I will add in 2027
Right now security.txt is good practice. From 11 December 2027, part of it stops being optional.
Annex I, Part II of the Cyber Resilience Act lists essential requirements for handling vulnerabilities. Point 5 asks for a coordinated vulnerability disclosure policy. Point 6 asks for a contact address so people can report what they find.
A security.txt file with a working Contact field covers point 6 on its own. Point 5 needs a real policy: how you triage, what you promise on timelines, whether you credit reporters. You can link that policy from the file with a Policy field.
Policy: https://example.com/security-policy
None of this carries a fine yet. The fines in Article 64 apply from 11 December 2027, same date as the rest of the annex. But the file takes ten minutes now, and the policy behind it takes longer than ten minutes to write well. Waiting until the deadline to start the policy is the mistake, not waiting to publish the file.
Why researchers check for it
A researcher who finds a bug has two options: email you and hope, or scan for security.txt and get a direct contact, an expiry date that proves someone maintains it, and sometimes a policy that tells them what happens next. Tools like SecurityTxt.org's validator and various vulnerability disclosure platforms check for this file automatically before a human ever reads the report.
No file means the researcher guesses, and they might post the bug on a forum instead, or just move on.
The other half: what depends on it
security.txt answers "how do I report a vulnerability." It doesn't answer "am I a manufacturer under the Cyber Resilience Act" or "what's actually in my dependency tree." Those questions come first, because the coordinated disclosure policy in Annex I only applies if the regulation applies to you at all.
I built a free scope check and a dependency scan for exactly that step, bundled with a starting kit for the annex requirements: https://crakit.eu/kit/?p=suivi-j14-en
Ten minutes for the file. Longer for the policy behind it. Start with the file.
Not legal advice.
Louann Duclos · CRA Kit · https://crakit.eu?p=suivi-j14-en
Top comments (0)