Free tool
security.txt generator and checker
A security.txt file tells security researchers how to reach you about a vulnerability. Fill in the form to write one, or paste yours to check it against RFC 9116.
Runs entirely in your browser: nothing you type or open is sent to us or stored.
Where to put it
Publish it at /.well-known/security.txt on every domain you use, served over https as text/plain. Signing it with OpenPGP is recommended.
security.txt and the Cyber Resilience Act
The CRA asks every manufacturer to provide a single point of contact where vulnerabilities in its products can be reported (Article 13(17)), and to have a coordinated vulnerability disclosure policy (Annex I, Part II). A security.txt file is the standard, machine-readable way to publish that contact: researchers and their tools look for it first.
Keep it current: a file whose Expires date has passed tells researchers the contact may no longer work. Provetry renews the one of each of your products for you.
Other free tools
- CVSS 3.1 calculator
Score a vulnerability from its eight base metrics, or paste a vector to read it.
- CVSS 4.0 calculator
The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.
- EPSS score lookup
How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.
- Vulnerability disclosure policy generator
A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.
- SBOM generator
Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.
- SBOM viewer and checker
Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.