Glossary: Policies, Standards and Risk Management

security.txt

Also written: /.well-known/security.txt

A small text file defined by RFC 9116, placed at /.well-known/security.txt on a website, that tells finders where to report flaws. Its Contact and Expires fields are required.

Where the book teaches it

Chapter 1: Guidelines and Standards
Chapter 3: Policies for Data, Access and Disclosure

Related terms

vulnerability disclosure policy request for comments (RFC)