sus.botdocs

Security finding

security.txt makes a promise the file itself breaks

Security Warning Severity: Low

Part of the audit Security claims and security.txt that the site contradicts. Finding id: security.securityTxtContradictions.

What it costs you

A researcher who finds the file expired or its links dead concludes that nobody maintains it and that a report may go unread. The claim was true when written; it no longer is.

What to do

Update the Expires date, fix or remove dead links, and make Canonical the address the file is served at. A person has to confirm the contact still works.

What it checks

  • Security.txt expired or links broken
  • Security.txt address differs from location

How to fix it

Bring the file up to date

  1. Set Expires to a date less than a year ahead.
  2. Open every address in the file (Policy, Hiring, Acknowledgments, Encryption) and fix or remove the dead ones.
  3. Set Canonical to the full https address of the file itself.
  4. Send a test mail to the Contact address and check that someone answers.
  5. If the file is signed, sign it again after editing.

How to check: curl -s https://www.example.com/.well-known/security.txt (use your own host; check Expires, Canonical and each link)

How to verify by hand

A person.

What this relies on

The claim was true when written.