Glossary: Vulnerability Management and Monitoring

security.txt

Also written: /.well-known/security.txt, Contact, Expires

A small text file at /.well-known/security.txt, defined by RFC 9116, that tells finders where to report flaws. Contact and Expires are required; Kettle & Crane's points to security@kettleandcrane.com and its policy.

Where the book teaches it

Chapter 3: Reporting Vulnerabilities
Chapter 6: What's next

Related terms

RFC responsible disclosure policy HTTPS