security.txt — A Standardised Point of Contact

security.txt arose from the security community’s need for a predictable way to contact an organisation about vulnerabilities. After several years of public development, the format was published in 2022 as RFC 9116.

A website normally publishes the file at /.well-known/security.txt. It must contain a security contact and an expiry date and may include fields for encryption keys, disclosure policies, acknowledgements and preferred languages. The well-known location allows researchers and automated tools to find this information without searching through the rest of the website.

RFC 9116 is an Informational RFC rather than an Internet Standards Track specification. It nevertheless followed the formal IETF process, received community review and uses a permanently registered well-known URI.

Adoption is clearly observable. Organisations including GitHub and Google publish the file, and CISA recommends its use as a simple component of vulnerability disclosure practice.

security.txt is not intended to explain website content to AI. It is included in this experiment as a point of comparison: a relatively mature machine-readable convention with a specific audience and established location. Requests for it may help show whether bots look broadly for well-known resources, rather than only for resources explicitly associated with AI.