RFC 9116 — security.txt
Identity & trust · IETF · Updated 2026-07-31
Status: Informational (IETF), published April 2022 · Authoritative source
A machine-parsable file that tells anyone — human researcher or automated scanner — where to report a security problem: two required fields, one fixed location, and an expiry date that keeps the answer honest.
RFC 9116 — which began as Edwin Foudil’s 2017 Internet-Draft — defines /.well-known/security.txt. Exactly two fields are required — Contact (a URI: mailto:, tel:, or a web form) and Expires, a timestamp after which the file should be considered stale. Optional fields add an OpenPGP Encryption key, a disclosure Policy, Preferred-Languages, and Canonical, which states the file’s authoritative URL — so a signed file can’t be replayed from somewhere it doesn’t belong. The RFC recommends (but does not require) an OpenPGP cleartext signature over the whole file.
Location matters: the file must live under /.well-known/ and be served over HTTPS; a top-level /security.txt is tolerated only as a legacy fallback, and when both exist the well-known copy wins. The mandatory Expires field is the RFC’s best idea — a security contact that was true in 2022 and never revisited is worse than none, and expiry makes staleness detectable by machine. Without the file, a researcher who finds a vulnerability on your site has no sanctioned channel to report it.
Adoption is small but compounding. A 2026 scan of 241 million gTLD domains (iotdef.com) found 573,000 serving the file — 0.24%, up sevenfold from 2021’s 82,000 (about 4.4× per-domain). Among the top million sites the rate is roughly 1.25% (URIports, 2025). Quality is improving too: 89% of 2026 files carry the once-rare Expires field. In the US it is more than endorsed: CISA’s Binding Operational Directive 20-01 requires security.txt on federal agencies’ primary .gov sites. For the agentic web the file is a preview of a broader pattern: its Security Considerations anticipate “reports being sent in an automated fashion” — automated reporters need a machine-readable answer too.
A typical security.txt
# /.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-06-30T00:00:00Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txtHow AgentGrade checks it
Not yet scored — security.txt is specced for the scanner’s well-known discovery sweep alongside the existing probes (agent card, x402.json, MCP manifest, signature directory). AgentGrade practices what this page preaches: agentgrade.com serves its own. Check yours: curl -s https://yoursite.com/.well-known/security.txt. Scan your site to see where you stand.
Related
All standards
RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · RFC 9116 · OAuth Discovery · RFC 7591 · RFC 9727 · ACP / UCP / AP2 · Index