Step 2 of 5 in Have I got the day-1 policies?
Research: referenced in the ENISA SME CRA Survey 2026.
A security.txt file (RFC 9116) tells security researchers how to report vulnerabilities to you. Fill in the fields below, then publish the file at /.well-known/security.txt on your website over HTTPS. It pairs perfectly with your CVD policy.
Required fields
Email or URL. Plain emails are turned into mailto: automatically.
RFC 9116 recommends an expiry less than one year away.
Optional fields
At least one Contact value is required.
# security.txt — generated with CRA Studio www.cra-studio.eu (RFC 9116) # Publish this file at https://<your-domain>/.well-known/security.txt over HTTPS. # ⚠ At least one Contact field is REQUIRED (e.g. a mailto: or https: URL). Expires: 2027-10-25T23:59:59.000Z Preferred-Languages: en, de
Need a CVD policy to go with it?
Generate a ready-to-publish Coordinated Vulnerability Disclosure policy with our free CVD tool.
Generated per RFC 9116. For production use, consider signing the file with PGP and keeping the Expires date current.