NeroToolHow to Create a security.txt File
A security.txt file gives security researchers a predictable place to find vulnerability reporting information. A small, current file can make responsible disclosure easier because it tells researchers where to send a report and where to find your security policy.
What is security.txt?
security.txt is a plain-text file intended to publish information about how a website or organization wants to receive vulnerability reports. It does not scan a website, prove that a security process exists or make an application secure by itself. Its role is practical: make the reporting path easier to discover.
Where should it be published?
The conventional location is /.well-known/security.txt. For a site at https://example.com, the public address is therefore https://example.com/.well-known/security.txt. The file should be reachable by researchers without needing an account or an authenticated session.
The Contact field
The most important piece of information is the reporting contact. This can be an email address such as mailto:security@example.com or another supported contact URL. Use an address that is monitored and that your organization can keep active over time.
Useful optional fields
Expires indicates when the published information should be reviewed. Preferred-Languages can tell researchers which languages your team can handle. Canonical identifies the preferred location of the file. Policy can point to a vulnerability disclosure or security policy. Acknowledgments can point to a page recognizing researchers who have reported issues.
Keep the file accurate
A security.txt file is only useful if its information remains current. Check that the contact address works, that linked policy pages are public and that the canonical URL matches the deployed file. Review the expiration date before it passes so researchers are not left with stale instructions.
Generate the file locally
NeroTool's Security.txt Generator lets you enter the relevant fields and create the plain-text file in your browser. You can review the generated lines before downloading it. The tool does not need to upload your contact details or create an account.