Security config
security.txt (RFC 9116) that a researcher can actually use
· Configuration notes, not a newsroom.
A missing /.well-known/security.txt is an info finding on SiteRune. Info still costs a point. Ship Contact and Expires. Do not invent a bug-bounty program you do not run.
Why it exists
Researchers looking at a host need a mailbox. RFC 9116 puts that at /.well-known/security.txt. Without it, mail bounces around contact forms and LinkedIn. SiteRune's sec-securitytxt finding is info-level because it is not an exploit — but we still deduct, because a 100 means the file is there.
Minimum file
Serve text/plain at https://<host>/.well-known/security.txt:
- Contact: mailto:security@your-domain (a box you read).
- Expires: an ISO date within a year so stale files die.
- Canonical: the same URL, so copies are obvious.
- Policy: a privacy or disclosure page you actually publish. Not a fictional bounty TOS.
What not to write
Do not invent a legal entity, a 24/7 SOC, or a paid program. SiteRune's ship tab will draft Contact and Expires from the host. Review the mailbox before you paste. If you do not want reports, say so — but then do not complain that people use 0-days instead.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.