security.txt

A security.txt file tells researchers where to report a problem.

What it is

The file lives at /.well-known/security.txt and holds a contact address, a policy link and an expiry date.

Why it matters

People who find a hole in a site look for a reporting address first. Without one, the report goes nowhere or goes public. The finding is informational.

How Tenty checks it

Tenty asks for /.well-known/security.txt and reads it.

How to fix it

Create the file with a Contact: line (an email address or a form) and an Expires: date, and serve it over https. securitytxt.org has a generator.

How to reproduce

curl -sS 'https://YOUR-APP/.well-known/security.txt'

A file with a Contact line means it is in place.