snag.page

Every check ยท Security contact

security.txt

disclosure/security-txt

What it checks

/.well-known/security.txt with a Contact line, not expired.

Why it matters

It tells someone who finds a flaw how to report it to you.

How to fix it

  1. Publish /.well-known/security.txt with a Contact line and an Expires date within a year.
  2. Renew the Expires date before it passes.
/.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-11-14T00:00:00Z

Check a site for this and everything else: snag.page.