The '.well-known/security.txt' file is a standardized method for organizations to communicate security-related information to security researchers, ethical hackers, and the general public. This initiative follows the precedent set by RFC 8615, which defines the '.well-known' directory for well-known URIs within a web server.
The concept of 'security.txt' was inspired by the need to centralize and standardize security policies, contact information, and disclosure policies for vulnerabilities. The proposal for this file was initially drafted by Edwin Foudil in 2016, and it gained traction through community involvement and discussion within the security community. Eventually, it was formalized under the Internet Engineering Task Force (IETF) as an Internet-Draft, leading to its standardization.
The primary purpose of the 'security.txt' file is to provide:
The 'security.txt' file should be placed in the '.well-known' directory of a web server, accessible via the URL /.well-known/security.txt. The file format uses plain text, adhering to a simple key-value pair structure, similar to robots.txt:
Contact: security@example.com
Encryption: https://example.com/pgp-key.txt
Disclosure: Full
Acknowledgment: https://example.com/hall-of-fame/
Some common fields used in 'security.txt' include:
While not universally adopted, several organizations, including major tech companies and government agencies, have implemented 'security.txt'. It has been recognized by bodies like the OWASP Foundation, which has included it in their recommendations for security practices.
Security researchers should verify the authenticity of the 'security.txt' file to prevent phishing or information leakage. This can be done by checking for HTTPS, verifying domain ownership, and ensuring the file's integrity through cryptographic means.