sus.botdocs

Security finding

security.txt is missing, expired, without contact or unsigned

Security Warning Severity: Low

Part of the audit security.txt. Finding id: security.securityTxt.

What it costs you

Someone who finds a flaw in your site looks here for where to report it. Without a current file with a contact, the report goes to a general mailbox, to nobody, or to the public.

What to do

Publish /.well-known/security.txt with a Contact and an Expires date less than a year ahead, and put a reminder in the calendar to renew it.

What it checks

  • No security contact file
  • Security contact file has expired
  • Security file has no contact address
  • Security file is not signed

How to fix it

Publish a current security.txt

  1. Use your own address and host. The mailbox must be read by someone who can act on a report.
  2. Set Expires less than a year ahead and renew the file before that date.
  3. Optional: sign the file with an OpenPGP cleartext signature (gpg --clearsign) and publish the signed version.

How to check: curl -s https://www.example.com/.well-known/security.txt (use your own host; expect the file, as text/plain)