security.txt
Anyone who finds a vulnerability in your product will first look on your website for an address. There is a standard for this: a text file in a fixed location that gives the contact, key and policy. The CRA does not require a format, but the German BSI recommends exactly this one.
security.txt is a standardised text file under RFC 9116 that a manufacturer places at /.well-known/security.txt on its website. It gives the contact address for vulnerability reports and further details such as encryption keys and the disclosure policy.
Definition in the Regulation
The Regulation does not define the term, and Regulation (EU) 2024/2847 does not prescribe a format. Under Annex I, Part II, point (6), it requires "a contact address for the reporting of the vulnerabilities discovered in the product with digital elements", and under Article 13(17) a single point of contact that is easily identifiable. Both obligations apply from 11 December 2027. The German BSI TR-03183-3 makes security.txt a minimum requirement for manufacturers in Germany; the guideline is voluntary, but it is the only specification from a public authority. RFC 9116 of the IETF (April 2022) defines the location, format and fields.
What it means for manufacturers
Under RFC 9116, only two fields are mandatory: Contact and Expires. TR-03183-3 requires more: Canonical, Encryption with a key for each address, Preferred-Languages including at least English, Policy with a link to the CVD policy, and an OpenPGP signature of the file. In the Contact field, the PSIRT's role address should come first, the CSIRT's second and the reporting form third. Expires may be no more than one year in the future, and the file should be checked quarterly. Common mistakes are an expired Expires date, the file only at /security.txt instead of under /.well-known/, a redirect to an HTML page and a mailbox that nobody reads. The file alone is not enough; it is the entrance to a process.
Free toolsecurity.txt generatorCreate the file in line with RFC 9116 or BSI TR-03183-3 in your browser, with every field explained.Create the file Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Single point of contact for vulnerabilities
- Coordinated vulnerability disclosure (CVD)
- PSIRT
- BSI TR-03183
- Beg bounty