Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

security.txt published

A way to report vulnerabilities (security.txt)

Can a researcher find out how to report a vulnerability?

Why it matters

Researchers who find a weakness often cannot find anyone to tell, so the report goes nowhere or goes public. A security.txt file at a standard address names the contact and stays current through an expiry date.

When a domain passes

Passes when the file is served over HTTPS at its standard address with a Contact field and one Expires date that is still in the future.

How to fix it

  1. Create a plain text file with Contact, Expires and Preferred-Languages fields.
  2. Serve it over HTTPS at its standard address and renew Expires before it lapses.
  3. Point Contact at a monitored mailbox or a disclosure form.

An example record

https://example.com/.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-12-31T21:00:00.000Z
Preferred-Languages: ar, en

Reference specifications

All thirteen standards