Runs on our server
security.txt checker
Is there a way to report a vulnerability?
The check runs on our server. We do not store the domain.
What this checks
RFC 9116 defines /.well-known/security.txt: a plain-text file that tells a security researcher who finds a bug on your site how to report it. This tool fetches it and requires at least one Contact: line before counting it as real — a catch-all page that answers 200 for any path doesn't qualify.
What to look for
No file means no published way to report a vulnerability responsibly, so a researcher who finds one has to guess an email address or post about it publicly instead. An Expires date past today means the file is stale and should be refreshed even if the contact details still work.