Updated July 15, 2026

security.txt fields reference (RFC 9116)

security.txt is a plain-text file at /.well-known/security.txt that tells researchers how to report a vulnerability. This sheet lists every RFC 9116 field, whether it is required, whether it may appear more than once, and what value it takes.

Fields

Field names are case-insensitive; values must be exact. Only Contact and Expires are required.

Field	Required	Repeatable	Purpose
`Contact`	Yes	Yes	How to report an issue — a mailto:, tel:, or https: URI. List the most preferred first.
`Expires`	Yes	No	ISO 8601 date-time after which the file should no longer be trusted. Exactly one.
`Encryption`	No	Yes	URI to a public key so reporters can encrypt sensitive details. Never a private key.
`Acknowledgments`	No	Yes	Link to a page that recognizes researchers who reported issues (US spelling, no middle 'e').
`Preferred-Languages`	No	No	One line of comma-separated RFC 5646 language tags, e.g. en, de. Order is not a priority.
`Canonical`	No	Yes	The canonical URI(s) of this file, used to verify authenticity — especially when signed.
`Policy`	No	Yes	Link to your vulnerability disclosure policy.
`Hiring`	No	Yes	Link to security-related job openings.
`CSAF`	No	Yes	Link to a CSAF provider-metadata.json for machine-readable security advisories.

Full example

A security.txt using the common fields, ready to adapt.

# Security disclosure details for example.com
Contact: mailto:security@example.com
Contact: https://example.com/security-report
Expires: 2027-01-01T00:00:00.000Z
Encryption: https://example.com/pgp-key.txt
Acknowledgments: https://example.com/hall-of-fame
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Hiring: https://example.com/jobs

Location and hostingServe the file at https://example.com/.well-known/security.txt over HTTPS with media type text/plain; charset=utf-8. A file at the site root (/security.txt) is legacy but allowed; .well-known is the canonical path.

Expires must stay in the futureThe Expires field is required and must be an ISO 8601 timestamp in the future. Keep it under a year out and refresh it — researchers are told to distrust an expired file.

Signing the fileYou can add an OpenPGP cleartext signature and publish it at /.well-known/security.txt.sig. Include a Canonical field so the signature can be checked against the expected URL.

References

Questions

Which security.txt fields are required?

Only Contact and Expires. Every other field — Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, Hiring, and CSAF — is optional.

Can a security.txt field appear more than once?

Most fields may repeat: Contact, Encryption, Acknowledgments, Canonical, Policy, Hiring, and CSAF. Expires and Preferred-Languages may appear only once.

Does the capitalization of field names matter?

No. Field names are case-insensitive, so `Contact` and `contact` are equivalent. The values — URLs, dates, and language tags — must still be exact.