security.txt
A cybersecurity industry standard defined by RFC 9116 that allows websites to place a structured text file at a fixed path, clearly informing security researchers how to report vulnerabilities. It serves as an infrastructure specification for responsible disclosure practices.
Core Facts
security.txt is a standardized text file placed in a website's root directory (typically at /.well-known/security.txt), conforming to RFC 9116, and is used to provide security researchers with a channel for reporting vulnerabilities.
The Hugging Face platform has deployed a security.txt file, accessible at https://huggingface.co/security.txt.
A security.txt file typically contains core fields such as Contact, Expires, Encryption, Policy, and Acknowledgments.
Timeline (last 90 days)
It is recommended that the expiration time of security.txt not exceed one year.
Contact and Expires are the minimum configuration required by the security.txt standard.
It is generally recommended to digitally sign the entire security.txt file using OpenPGP to prevent attackers from tampering with its contents.
The adoption rate of security.txt in the self-hosting community is not high.
The purpose of security.txt is to provide a unified channel for websites and online services, allowing security researchers to quickly find an organization's security contact information.
security.txt uses a key-value pair format, with Contact as a required field that can be an email address, phone number, or contact page URL.
security.txt is a low-cost, high-value practice; it does not make a service more secure, but it makes the path from discovering a problem to resolving it smoother.
For users running servers such as Caddy or Nginx, usually just a few lines of configuration are needed to serve the security.txt file publicly.
It has become habitual practice for security researchers to first check a target site's /.well-known/security.txt upon encountering a suspected vulnerability.
security.txt is an industry standard defined by RFC 9116.
10 more timeline events
All Facts (20)
security.txt is a standardized text file placed in a website's root directory (typically at /.well-known/security.txt), conforming to RFC 9116, and is used to provide security researchers with a channel for reporting vulnerabilities.
70%VerifiedThe Hugging Face platform has deployed a security.txt file, accessible at https://huggingface.co/security.txt.
65%VerifiedA security.txt file typically contains core fields such as Contact, Expires, Encryption, Policy, and Acknowledgments.
65%UnverifiedIt is generally recommended to digitally sign the entire security.txt file using OpenPGP to prevent attackers from tampering with its contents.
50%UnverifiedThe adoption rate of security.txt in the self-hosting community is not high.
50%UnverifiedContact and Expires are the minimum configuration required by the security.txt standard.
50%Unverifiedsecurity.txt is a low-cost, high-value practice; it does not make a service more secure, but it makes the path from discovering a problem to resolving it smoother.
50%UnverifiedFor users running servers such as Caddy or Nginx, usually just a few lines of configuration are needed to serve the security.txt file publicly.
50%UnverifiedIt is recommended that the expiration time of security.txt not exceed one year.
50%UnverifiedThe purpose of security.txt is to provide a unified channel for websites and online services, allowing security researchers to quickly find an organization's security contact information.
50%Unverifiedsecurity.txt uses a key-value pair format, with Contact as a required field that can be an email address, phone number, or contact page URL.
50%UnverifiedIt has become habitual practice for security researchers to first check a target site's /.well-known/security.txt upon encountering a suspected vulnerability.
50%Unverifiedsecurity.txt is an industry standard defined by RFC 9116.
50%UnverifiedThe Contact field of security.txt provides the security team's email address, page link, or phone number for researchers to report vulnerabilities.
50%UnverifiedOptional fields of security.txt include Policy, Acknowledgments, Hiring, and Preferred-Languages.
50%UnverifiedDeploying security.txt is a low-barrier security best practice for publicly facing services that requires no additional server costs.
50%UnverifiedThe prevalence of security.txt is often used as a reference indicator for measuring a company's security maturity.
50%UnverifiedA security.txt file alone cannot prove that a platform is absolutely secure; true security capability is reflected in a defense-in-depth system encompassing vulnerability response speed, model scanning mechanisms, access control, and supply chain verification.
50%UnverifiedMajor internet companies including Google, GitHub, and Meta have deployed security.txt.
50%UnverifiedHugging Face left a comment in its security.txt file directly addressing AI agents that may be accessing the site in an automated manner.
50%