security.txt generator

RFC 9116 gives researchers one standard place to find your security contact: /.well-known/security.txt. If a researcher finds an actively exploited vulnerability in your product, this file decides whether they reach you — or your regulator learns first. 30 seconds, free, runs locally.

Security contact (email or URL) — required Expires (RFC requires a date; max ~1 year out) — required Vulnerability disclosure policy URL (optional) Preferred languages (optional) Canonical URL of this file (optional but recommended)

Upload it to https://yourdomain/.well-known/security.txt. Consider signing it (see RFC 9116 §2.3).

Free tool from CRA Incident Drill — the 7-minute readiness check for the EU Cyber Resilience Act's 24-hour reporting rule (live 11 September 2026). Nothing you type leaves your browser.