No security.txt
If this finding appears in a report, the sampled /.well-known/security.txt location did not provide a recognised disclosure file. This is not a live diagnosis of your site. A missing file does not establish that the organisation has no reporting channel or is vulnerable. Other audit tools often report this finding as "security.txt missing".
Why this matters
RFC 9116 defines a discoverable contact format that complements other disclosure channels. Its usefulness depends on accurate details and a monitored response process. Publishing the file does not certify security or authorise testing.
How to fix it
Confirm the responsible contact and disclosure process first. If appropriate, serve a UTF-8 plain-text file over HTTPS at /.well-known/security.txt. Include a valid Contact URI and one RFC 3339 Expires value; use a real monitored address or HTTPS reporting page. Verify the deployed content, redirects and Content-Type, test the contact through the approved internal process and schedule renewal before expiry. Do not publish an invented contact or unapproved policy. See RFC 9116 for additional fields and scope.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit