Security.txt Checker: Validate Against RFC 9116
Find and validate a site's security.txt file.
security.txt says whom to contact. To tell researchers what they may test, publish a hacker.txt too: HackerTXT generates one, and you can link it from the Policy field.
Use via API
Find a site's security.txt (/.well-known/security.txt, then /security.txt) and validate it against RFC 9116, or validate content you pass in. Send JSON, get JSON back; this one reaches the network from PithLab’s server.
POST https://pithlab.com/api/v1/tools/security-txt-checker
curl https://pithlab.com/api/v1/tools/security-txt-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"content":"Contact: mailto:[email protected]\nExpires: 2030-01-01T00:00:00.000Z"}'About the Security.txt Checker
Fetch a site's security.txt from /.well-known/ and check it against RFC 9116: Contact and Expires present, not expired, Canonical, encryption, policy and signature.
How to use the Security.txt Checker
- Enter a website, such as example.com, or switch to Paste to check a file you're writing (pasted files are checked in your browser).
- Press Check. PithLab's server fetches https://<site>/.well-known/security.txt, and /security.txt if that's missing.
- Read the fields found and the problems to fix: required fields, expiry, URL formats, Canonical and signature.
Examples
Input
Contact: mailto:[email protected] Expires: 2027-10-20T00:00:00.000Z Canonical: https://example.com/.well-known/security.txt Policy: https://example.com/hacker.txt Preferred-Languages: en
Output
Valid. Suggestions: no Encryption key, and the file isn't digitally signed.
Frequently asked questions
What is security.txt?
A small text file, standardised in RFC 9116, that tells security researchers how to report a vulnerability to you. It lives at /.well-known/security.txt and needs at least a Contact and an Expires field.
Why does security.txt need an expiry date?
So stale contact details aren't trusted forever. Set Expires less than a year ahead and update it when you review the file. Once it's past, researchers should treat the file as out of date.
What's the difference between security.txt and hacker.txt?
security.txt says who to contact about vulnerabilities. A hacker.txt file says what researchers may test and how, such as scope, rate limits and safe harbour. HackerTXT (hackertxt.com) generates one, and you can link it from security.txt's Policy field.