# Does your site tell security researchers how to reach you?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The security contact check looks for a current security.txt file. Here is what it should contain and why a missing one is not a vulnerability.

The security contact check looks for a current security.txt file, the standard place where people who find a problem learn how to report it. A missing or expired file means reports have nowhere obvious to go.

## What does this check look at?

It looks at whether your site publishes a current security.txt file that tells people how to report a problem. The format comes from `RFC 9116`, which defines a machine-parsable file to make it easier for researchers to report vulnerabilities.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Pass | A current file was found. | Keep its expiry date in the future. |
| Attention | The file is missing or has expired. | Publish one with a contact and an expiry date. |
| Not tested | The file could not be read. | Nothing to act on. |

Publishing one does not make the software safer, and a missing file is not a vulnerability. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | People who want to report a problem |
| The protection that should stop it | No current security.txt contact |
| What is reached | Reports have nowhere to go |
| What follows | Slower responses to reported issues; no weakness on its own |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

The file is a few lines of plain text in your site’s well-known folder.

:::fix-prompt any
Create a security.txt file for my site, served from the .well-known folder at the root of my domain. Include a Contact line with an email address or form I check, an Expires line one year from today in ISO 8601 format, and a Preferred-Languages line. Make sure it is served as plain text over HTTPS, and add a reminder to my calendar notes to renew the Expires date.
:::

## How to check

Say Atlas, our example app at `atlas.example`, published a file two years ago and never updated it. The expiry date has passed, so the check asks for a new one.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is a missing security.txt a vulnerability?

No. It is information. It only means someone who finds a problem may not know how to tell you.

### Do I need a bug bounty to publish one?

No. A contact address and an expiry date are enough. You can add a policy link later.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [RFC 9116, A File Format to Aid in Security Vulnerability Disclosure](https://www.rfc-editor.org/rfc/rfc9116.html), RFC Editor, read on 2026-10-07