Internet Assigned Numbers Authority
  • Domains
  • Protocols
  • Numbers
  • About

                                                                 security.txt Fields

Created
        2021-07-13

Last Updated
        2026-03-07

Available Formats
        [IMG]
        XML [IMG]
        HTML [IMG]
        TXT

Registry Included Below

  • security.txt Fields

security.txt Fields

Registration Procedure(s)

             Expert Review


Expert(s)

             Yakov Shafranovich, Edwin Foudil


Reference
        [RFC 9116]

Available Formats
        [IMG]
        CSV

    Field Name                            Description                         Multiple   Status  Change Controller              Reference
                                                                             Appearances
Acknowledgments     link to page where security researchers are recognized   yes         current IETF              [RFC 9116]
Canonical           canonical URI for this file                              yes         current IETF              [RFC 9116]
Contact             contact information to use for reporting vulnerabilities yes         current IETF              [RFC 9116]
CSAF                Link to a provider-metadata.json resource of the Common  yes         current [OASIS_Open]      [Common Security Advisory Framework
                    Security Advisory Framework (CSAF)                                                             Version 2.0, OASIS Standard]
Expires             date and time after which this file is considered stale  no          current IETF              [RFC 9116]
Encryption          link to a key to be used for encrypted communication     yes         current IETF              [RFC 9116]
Hiring              link to the vendor's security-related job positions      yes         current IETF              [RFC 9116]
Policy              link to security policy page                             yes         current IETF              [RFC 9116]
Preferred-Languages list of preferred languages for security reports         no          current IETF              [RFC 9116]
                    A project or company that may financially reward                                               [Software Engineering Institute,
                    reporters via a bug bounty program as per section 3.5.5                                        "The CERT Guide to Coordinated
Bug-Bounty          of [CERT.CVD] can indicate this by adding the line       no          current IETF              Vulnerability Disclosure", Carnegie
                    "Bug-Bounty: True". Adding the line "Bug-Bounty: False"                                        Mellon University,
                    indicates that no financial reward via a bug bounty                                            CMU/SEI-2017-SR-022, August 2017]
                    program can be offered.

                                                                 Contact Information

     ID         Name                Contact URI             Last Updated
[OASIS_Open] OASIS Open mailto:project-admin&oasis-open.org 2023-02-15
                        https://www.oasis-open.org

Licensing Terms