# security.txt (RFC 9116)

> security.txt (RFC 9116): Provides a responsible disclosure channel for agent-related security incidents. The fix: publish security.txt.

- Source: /checks/security-txt
- Site: AgenticWebScore
- Language: English

---
Provides a responsible disclosure channel for agent-related security incidents.

| Property | Value |
| --- | --- |
| Check id | `security-txt` |
| Dimension | Bot Access Control (18%) |
| Tier | Recommended — pool 20 pts |
| Weight inside tier | 1 |
| Impact | Low |
| Maturity | Adopted — A ratified standard with real deployment. |
| Conditional | No |
| Publishing skill | `security-txt` |
| Standards | RFC 9116 |

## What the scanner requests

- `/.well-known/security.txt`
- `/security.txt`

## What is measured

The scanner requests /.well-known/security.txt, falls back to /security.txt while following redirects, and expects HTTP 200 with a text/plain body as RFC 9116 requires. It passes when the file carries a Contact field and an Expires field whose RFC 3339 timestamp is in the future, returns partial when one of those fields is missing or Expires is malformed or already past (the file is then stale), and fails when both paths answer non-200 or return HTML.

## Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

```bash
DOMAIN="example.com"
for P in /.well-known/security.txt /security.txt; do echo "$P -> $(curl -sS -o /dev/null -w '%{http_code} %{content_type} %{redirect_url}' "https://$DOMAIN$P")"; done; curl -sSL "https://$DOMAIN/.well-known/security.txt" | grep -Ei '^(contact|expires|canonical|policy|preferred-languages):'
```

## The fix

This is the artifact to ship. It is the complete change, not a description of one.

```text
# security.txt - RFC 9116
Contact: mailto:security@example.com
Expires: 2027-09-30T18:37:07Z
Canonical: https://example.com/.well-known/security.txt
Preferred-Languages: en
Policy: https://example.com/security-policy
Acknowledgments: https://example.com/hall-of-fame
```

> Contact and Expires are the only mandatory fields and an Expires value in the past makes the whole file stale, so keep the date less than a year out; serve it as text/plain over HTTPS and redirect /security.txt to the /.well-known/ path.

## Standards referenced

- `RFC 9116`

## Related checks

| Check | Tier | Impact | Same skill |
| --- | --- | --- | --- |
| `webbotauth` — Web Bot Auth key directory | Essential | Critical | — |
| `agent-permissions` — Agent permission model (agent-permissions.json) | Essential | Critical | — |
| `ai-rules` — Named AI bot rules in robots.txt | Essential | High | — |
| `ai-policy` — AI usage policy page | Essential | High | — |
| `bot-page` — Crawler and agent policy page | Recommended | Medium | — |
| `crawl-delay` — Crawl rate declaration | Emerging | Low | — |
| `ai-txt` — /ai.txt access declaration | Emerging | Low | — |