Skip to content

Security

What is security.txt and should I have one

It is a two-line file naming where to send a security report. Without it, someone who finds a problem in your product has to guess — and the usual outcome is that they post it publicly instead of telling you.

What 13x checks

This is rule security.security-txt in the public registry: security.txt for vulnerability reports. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
2 of the readiness score
Scope
Runs on every audited page
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Add /.well-known/security.txt:

Configuration
Contact: mailto:security@example.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

Contact and Expires are the only required fields. Serve it as text/plain.

Without it, someone who finds a problem has to guess where to report it, and the usual outcome is a public post instead of a private email. Make sure the address actually reaches someone.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks