Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

security.txt and the CRA contact point for vulnerabilities

6 min read

On this page
  1. What the CRA asks
  2. The standard: RFC 9116
  3. An example
  4. Getting it right
  5. How Provetry helps
  6. Sources

A researcher finds a vulnerability in your product. Where do they write? Too often the answer is a generic contact form, a sales address, or nothing at all, and the report gets lost or published without warning. A security.txt file fixes that in one small text file, placed at a predictable address, that tells anyone who to contact and how.

What the CRA asks

The Cyber Resilience Act makes a reachable contact point an obligation for every manufacturer:

  • Annex I, Part II, point 6 asks manufacturers to facilitate the sharing of information about potential vulnerabilities, including by providing a contact address for reporting them.
  • Article 13(17) asks them to designate a single point of contact that users can use to report vulnerabilities, and to make it easy to find.
  • Annex II, point 2 lists that contact point among the information that must accompany the product.

The regulation does not name security.txt. But it is the internet standard for exactly this purpose, it is what researchers and scanners look for first, and it costs nothing.

The standard: RFC 9116

security.txt was published by the IETF as RFC 9116 in April 2022. The file lives at:

https://example.com/.well-known/security.txt

It must be served over HTTPS, as plain text (text/plain; charset=utf-8). Each line is a field and a value:

Field Required What it says
Contact Yes, at least one Where to report: a mailto:, https:// or tel: address. Several lines allowed, in order of preference
Expires Yes, exactly one The date after which the file must not be trusted. Keep it less than a year ahead
Encryption No Where to find your OpenPGP key, so reports can be encrypted
Policy No The address of your vulnerability disclosure policy
Acknowledgments No A page thanking the researchers who reported to you
Preferred-Languages No Languages you read reports in, such as en, fr
Canonical No The address(es) where this file is meant to live, to detect copies
Hiring No Security jobs, if you want to mention them

Machine-readable security advisories add one more: the CSAF field, defined by the OASIS CSAF 2.0 standard, points to your provider-metadata.json so tools can find your advisories.

An example

Contact: mailto:security@acme.example
Contact: https://acme.example/security/report
Expires: 2027-10-31T23:00:00.000Z
Encryption: https://acme.example/.well-known/openpgp-key.asc
Policy: https://acme.example/security/disclosure-policy
Acknowledgments: https://acme.example/security/thanks
Preferred-Languages: en, fr
Canonical: https://acme.example/.well-known/security.txt
CSAF: https://acme.example/.well-known/csaf/provider-metadata.json

You can write and check yours with our free security.txt generator and checker.

Getting it right

  • Do not let it expire. The Expires field is required precisely so that stale files are ignored. A file that expired last spring tells researchers nobody is reading. Put a reminder in your calendar a month before the date, and rewrite the file each year.
  • Use an address that a person reads. A shared security@ mailbox monitored by more than one person, with an automatic acknowledgement, is the usual choice. Under the CRA, a report about an exploited vulnerability can start a 24-hour clock: it must not sit unread over a holiday.
  • Link your policy. The Policy field should point to a published coordinated vulnerability disclosure policy, which the CRA also requires.
  • Sign it if you can. RFC 9116 recommends an OpenPGP cleartext signature around the file, so readers can check it was not tampered with.
  • One file per domain. Put it on every domain that hosts a product or its services, or redirect them to the main one.
  • Mention it in your product documentation, so the CRA’s single point of contact is also where users will look: the user instructions, the support page, the app’s “about” screen.

How Provetry helps

On paid plans, Provetry writes your coordinated disclosure policy and a security.txt from a few answers, lists your products and their support periods, and adds the CSAF line once you open a public advisories page and save your answers again. The file must be rewritten before it expires; the disclosure page warns you in the month before.

Sources