← methodology

security.txt

usability.security-txt · Usability · 1 pts · recommended

Goal

Can an agent use you reliably in production?

Response hygiene, TLS and redirect discipline, and security contact channels agents depend on at runtime.

How we test

Fetched /.well-known/security.txt and validated Contact + Expires.

How to pass

Publish RFC 9116 /.well-known/security.txt with a Contact and a future Expires.

Spec

https://www.rfc-editor.org/rfc/rfc9116 ↗

Verify a fix

curl -X POST /api/scan/checks \
  -H 'content-type: application/json' \
  -d '{"url": "yourdomain.com", "checkIds": ["usability.security-txt"]}'