Create a Standards-Shaped security.txt Draft Locally

How to Use This Tool

This generator creates a plain-text vulnerability-disclosure contact draft in the browser. It does not crawl a domain, test the deployed file or decide who should receive sensitive reports.

The operational problem

A researcher who cannot find an authorized reporting channel may disclose a vulnerability through the wrong mailbox or abandon the report. RFC 9116 supplies a machine-parsable convention, but publishing a syntactically neat file with an unmonitored address is worse than documenting the real escalation path.

How to create the draft

Enter an actively monitored security email, a UTC expiration date written as YYYY-MM-DD, comma-separated language codes, the disclosure-policy URL and the final canonical URL. The output places one field on each line and converts the contact to a mailto URI. Copy the text only after an authorized owner confirms every destination.

Required fields and expiration

RFC 9116 requires at least one Contact field and an Expires field. Expiration is maintenance, not decoration: choose a future review horizon the organization will actually renew. The generator checks calendar shape and URL schemes, but deliberately does not use today's date as a hidden policy or promise that a future calendar date is operationally appropriate.

Deployment boundary

Serve the final UTF-8 plain-text file over HTTPS at the well-known location for the intended scope. Check status code, content type, redirects, canonical value and caching from outside the deployment. The page does not deploy, sign, encrypt or submit vulnerability information.

Privacy and safety

The entered contact details stay in browser JavaScript unless the user copies and publishes them. Use a role mailbox rather than a personal address when the organization's process requires continuity, and never place a secret, private key or unreviewed internal escalation detail in a public security.txt file.

Evidence

The field grammar and placement guidance were reviewed against IETF RFC 9116 on 2026-08-26. Reopen the RFC when maintaining the template, and test the deployed resource independently; generating text is not the same as operating a disclosure program.