Publish a security.txt file

wellknown-security-txt

security.txt tells researchers where to send a vulnerability report instead of guessing at an inbox or posting it publicly. Add one known path.

Why this matters

A security.txt file helps security researchers report bugs to you responsibly. Missing or incomplete, but not a vulnerability. Just a missed opportunity.

Your stack

CDN and edge

Vercel

Web servers

Nginx

Frameworks

Next.js

Vercel

1 Create a public/.well-known/security.txt file in your project

Contact: mailto:[email protected]
Expires: 2026-12-31T23:59:59.000Z
Preferred-Languages: en

Nginx

1 Create a security.txt file at /.well-known/security.txt
2 Include at least Contact and Expires fields

# Create .well-known/security.txt
Contact: mailto:[email protected]
Expires: 2026-12-31T23:59:59.000Z
Preferred-Languages: en

Does your app still have this?

Scan your domain