Featured research CVE-2026-81963 Local privilege escalation in the Windows Update Stack through link following Lire en français FR
Contact

Free tool · runs in your browser

security.txt Studio

Locally review fields, URIs and dates in a security.txt file, then generate a minimal baseline without opening referenced links.
Local processing No data sent No account Reporting

Powered by RFC 9116 (IETF)

security.txt file

UTF-8 text, up to 64 KiB. Referenced contacts, policies and keys are never opened.

Minimal generator

Generate a compliant baseline, then publish it under /.well-known/security.txt over HTTPS.

What is a security.txt file?

security.txt is a text file standardised by RFC 9116 that tells researchers how to report a vulnerability. Published under /.well-known/security.txt over HTTPS, it provides at least a contact and an expiry date. By itself, it does not grant permission to test a system.

Security contacts and testing authorisation

security.txt describes how to submit a vulnerability. It requires at least one Contact and exactly one Expires. It proves neither publisher identity nor permission to test: verify the signature, domain and policy through independent channels.

Correct publication

The authoritative file is published as UTF-8 under /.well-known/security.txt, over HTTPS with a text/plain media type. A short expiry forces regular review of contacts and disclosure rules.

?Frequently asked questions

Does the tool download referenced links?

No. It only checks the pasted text syntax. No contact, PGP file, domain or policy is opened.

Is an OpenPGP signature verified?

No. A signed block is recognised and its contents reviewed, but the signature must still be checked with a key obtained through a trusted channel.

Does security.txt authorise testing?

No. RFC 9116 states that the presence or absence of the file neither grants nor denies permission to test. The linked policy should define scope.

+More tools

  • [•••]
    Evidence Sanitizer

    Mask secrets, emails and IPv4 addresses before sharing evidence.

  • ±HTTP
    HTTP Evidence Diff

    Compare two sanitised HTTP messages without replaying them.

  • 9.8
    CVSS Calculator

    CVSS 4.0 and 3.1: score, vector and severity, live.

Technical assessment

Request an application or infrastructure assessment

For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.

Discuss my projectCompare solutions

    Quick access