security.txt validate & build

Check a security.txt against RFC 9116, or generate a correct one. Everything runs in your browser.

Validate a security.txt

Paste the full contents of the file. Nothing is uploaded: the page makes no network request.

Paste a file and click "Validate".
You get a line-by-line view and a list of RFC 9116 findings.

Get a domain's file

RFC 9116 puts the file at /.well-known/security.txt (a legacy copy may sit at /security.txt).

Why this page does not fetch it for you

A browser may only read another site's file if that site sends CORS headers. Tested in headless Chrome: github.com, google.com and cloudflare.com sent none, and hbenali.ovh redirects to a host that answers 404, so every request was blocked. Even where it could work, this page's strict Content Security Policy (connect-src 'none') cannot allow an arbitrary domain. So the fetch is done with curl, then you paste the output above.

security.txt generator

One value per line in the multi-value fields. Publish the result at /.well-known/security.txt over HTTPS.

email addresses become mailto:; also https: and tel: URIs
UTC date-time; defaults to one year ahead (less one day, as RFC 9116 asks for under a year)
comma-separated language tags, written once
https:, dns: or openpgp4fpr: URI of a key, never an email address
the https URL(s) where this exact file is served
Generated file

Signing (OpenPGP clearsign, recommended by RFC 9116) is not done here: run gpg --clearsign security.txt on the downloaded file.