Check if a domain publishes a security.txt file (RFC 9116) with responsible disclosure contact information.
Enter a domain to fetch its security.txt file
Fill in the fields to build the file for your own site. Nothing you type leaves your browser.
Security.txt (RFC 9116) is a proposed standard that lets organizations define how security researchers should report vulnerabilities. The file is placed at /.well-known/security.txt and contains fields like Contact: (required), Expires:, Encryption:, and Policy:. This checker fetches both the RFC 9116 canonical location and the legacy root path, validates the Expires field, and surfaces all defined fields.
Sent to our server: Domain. We fetch files from that site. To answer a repeated check fast, we have to keep answers for 1 hour; then they are deleted. Also added to the page link, so you can share the result: Domain.