security.txt
A file at /.well-known/security.txt, defined by RFC 9116, giving a contact for reporting vulnerabilities and an expiry date for that information. It is included here as the contrast case: a well-known machine file with an actual standard behind it, which llms.txt, ai.txt and agents.md do not have.
What security.txt does not show
It supports exactly one claim, that a reporting route is published; its presence says nothing about the site's security, and an expired one is worse than none because it is a promise nobody kept.
Where security.txt comes up on this site
- security.txt (RFC 9116): fields, expiry and locationGeneric contact forms go to sales, social accounts go unread, and the report stalls. security.txt fixes that with a small file in a fixed location that names the right contact.
Terms this definition uses
Related terms in Machine files
The files addressed to machines rather than readers, and what publishing one does and does not buy.
llms.txt · llms-full.txt · agents.md · entity map · entity map parity · machine layer · well-known URI · MCP · agent card · sitemap index · OpenAPI specification · ai.txt · Tool definition · SKILL.md · sitemap origin error · soft 404 on a machine file · tdmrep.json · TDM exception · Content Signals · HTTP Message Signatures · changefreq and priority · staging leak · host duplicate
Questions about security.txt
What is security.txt?
A file at /.well-known/security.txt, defined by RFC 9116, giving a contact for reporting vulnerabilities and an expiry date for that information. It is included here as the contrast case: a well-known machine file with an actual standard behind it, which llms.txt, ai.txt and agents.md do not have.
What does security.txt not show or guarantee?
It is included here as the contrast case: a well-known machine file with an actual standard behind it, which llms.txt, ai.txt and agents.md do not have. It supports exactly one claim, that a reporting route is published; its presence says nothing about the site's security, and an expired one is worse than none because it is a promise nobody kept.
Which area of the glossary does security.txt belong to?
Machine files: The files addressed to machines rather than readers, and what publishing one does and does not buy.
← TDM exception · Content Signals →
See it in the full glossary · 731 terms across 19 areas.