The one file that makes shakedown artists move on

Put yourself in the shoes of someone who just noticed a real problem on your site. Maybe a friendly developer, maybe not. They want to tell you — but there's no security contact anywhere, no obvious inbox, just a generic hello@ that may or may not be read. So they're left with two bad options: post it publicly and hope that gets your attention, or lean on you for a “reward” before they'll say what it is.

A security.txt file removes that fork in the road. It's a tiny plain-text file at a standard location that says, in effect, “here's exactly where to send security reports.” With a channel that obviously exists, the quiet heads-up becomes the easy path — and the shakedown email starts to look like more effort than it's worth.

What it actually signals

The file does two jobs at once, and the second one is the underrated part:

The exact file to ship

There's no framework and no build step here — it's a text file. At minimum you need a Contact: and an Expires: line. Paste this, swap in your details:

Contact: can be an email, a form URL, or both (add a second Contact: line). Expires: is required by the spec — set it a year out so the file can't rot into a dead address forever. Everything else (Encryption: for a PGP key, Policy: for your disclosure terms) is optional polish.

Where it goes

1. 1

   Put it at /.well-known/security.txt.

   The canonical location is https://yourdomain.com/.well-known/security.txt. That's the path scanners and researchers check first. A copy at the root (/security.txt) is allowed as a fallback, but the .well-known path is the one that counts.
2. 2

   Serve it as plain text over HTTPS.

   It should return 200 with content-type: text/plain. Most static hosts serve files from a public/ directory — drop it in public/.well-known/security.txt and it ships as-is. No route handler needed.
3. 3

   Point it at an inbox someone reads.

   This is the part that makes it real. A security@ address nobody checks is worse than none — it looks responsive and isn't. Route it to wherever you'll actually see it, and put the expiry on your calendar so you renew before it lapses.

Be honest about what this is

This is not a vulnerability fix, and we won't pretend it is. If your .env is public or a live key is in your bundle, fix that first — a disclosure address on a leaking site just tells people where to send the bad news. Think of security.txt as hygiene and signaling: it lowers the odds that an honest finding turns into a public mess or a ransom note. Cheap to add, and it changes the tone of the conversation before it even starts.

One text file, one inbox, five minutes — and the next person who finds something on your site has a reason to just tell you.