For full-stack developers, security engineers, and technical founders, ensuring your product’s domains comply with global security standards like SOC2, ISO 27001, or NIS2 is a critical operational priority.
The global internet standard RFC 9116 defines a standardized way to handle vulnerability reporting: by hosting a plain-text file at /.well-known/security.txt.
However, if your public marketing page or documentation is hosted on a restricted static CMS (like Blogger, Shopify, Webflow, or Wix), uploading custom files to the root /.well-known/ directory is blocked.
To solve this platform bottleneck, I designed and open-sourced cloudflare-security-txt—an enterprise-grade, serverless Cloudflare Worker template to deploy your security policy instantly at the edge.
How to Serve It Natively
Instead of hosting a static file, our worker intercepts requests at Cloudflare's global edge network in under 10ms, serving your policy with high-security mime-types and CORS headers
`/**
- Cloudflare Worker: security.txt (RFC 9116 Compliant)
- ──────────────────────────────────────────────────
- Easily deploy a compliant vulnerability disclosure policy at /.well-known/security.txt */
const SECURITY_TXT_CONTENT = `# ============================================================
security.txt — Vulnerability Disclosure Policy (RFC 9116)
============================================================
Contact: mailto:security@yourdomain.com
Contact: https://www.yourdomain.com/security
Expires: 2027-12-31T23:59:59.000Z`;
export default {
async fetch(request, env, ctx) {
const url = new URL(request.url);
// Intercept both standard /.well-known/security.txt and fallback /security.txt paths
if (url.pathname === '/.well-known/security.txt' || url.pathname === '/security.txt') {
return new Response(SECURITY_TXT_CONTENT, {
headers: {
'content-type': 'text/plain; charset=utf-8',
'cache-control': 'public, max-age=86400',
'x-content-type-options': 'nosniff'
},
});
}
// Fail-safe: Proceed directly to your origin server (Blogger/Shopify/etc.)
return fetch(request);
},
};`
Why This Template Is Enterprise-Grade
⚙️ Dynamic Auto-Expiration: It automatically calculates and updates the mandatory Expires: date to exactly 1 year in the future, making the deployment completely maintenance-free.
🔐 Dual Route Serving: Supports serving both your raw security policy (/.well-known/security.txt) and its cryptographic GPG signature (/.well-known/security.txt.sig) natively for security audits.
🌐 Global CORS Support: Enforces wildcard CORS headers, allowing automated global compliance scanners and vulnerability crawlers to parse your security files cleanly.
Top comments (0)