> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Publish a security.txt!
- URL: https://securinglaravel.com/security-tip-securitytxt/
- Published: 2021-12-03T01:00:44.000Z
- Updated: 2024-10-03T03:42:14.000Z
- Description: [Tip #9] security.txt is a simple way to share your security contacts to make vulnerability reporting easier.
- Author: Stephen Rees-Carter
- Tags: Security Tips, security.txt

The `security.txt` file is a standard for defining the security policies of a website. It lives in the `/.well-known/` subdirectory and should be a publicly readable text file. The goal of a `security.txt` file is to make it simple for anyone wishing to report a security concern to get in contact with the right person quickly, without needing to dig through subpages and support docs to find the right email, or having to convince a support rep about an issue and jump through support hoops.

The best place to get started is: [**https://securitytxt.org/**](https://securitytxt.org/?ref=securinglaravel.com)

There you will find a wizard to help you build your own `security.txt` file. Once you have the file, simply upload it to your site as: `/.well-known/security.txt`.

For example, this is the `security.txt` file on my site:   
[https://stephenreescarter.net/.well-known/security.txt](https://stephenreescarter.net/.well-known/security.txt?ref=securinglaravel.com)

```
Contact: mailto:stephen@rees-carter.net
Contact: https://twitter.com/valorin
Expires: 2028-09-14T14:00:00.000Z
Encryption: https://keybase.io/valorin
Encryption: https://stephenreescarter.net/pgp-key.txt
Preferred-Languages: en
```

And the one on [google.com](https://www.google.com/.well-known/security.txt?ref=securinglaravel.com):

```
Contact: https://g.co/vulnz
Contact: mailto:security@google.com
Encryption: https://services.google.com/corporate/publickey.txt
Acknowledgements: https://bughunters.google.com/
Policy: https://g.co/vrp
Hiring: https://g.co/SecurityPrivacyEngJobs
```

[amazon.com](https://www.amazon.com/.well-known/security.txt?ref=securinglaravel.com):

```
Contact: https://hackerone.com/amazonvrp/reports/new
Hiring: https://www.amazon.jobs/en/teams/infosec

# Bug Bounty Policy:
Policy: https://hackerone.com/amazonvrp

# For vulnerabilities related to Amazon Web Services (AWS):
https://aws.amazon.com/security/vulnerability-reporting/
```

If you want to keep digging into more examples, [Scott Helme](https://scotthelme.co.uk/?ref=securinglaravel.com) maintains a list of sites in the Top 1 Million Sites which have a `security.txt` file: [https://crawler.ninja/files/security-txt-sites.txt](https://crawler.ninja/files/security-txt-sites.txt?ref=securinglaravel.com)

---

**Found this security tip helpful?* Don't forget to* [*subscribe*](https://securinglaravel.com/#/portal/signup) *to receive new* [*Security Tips*](https://securinglaravel.com/tag/tips/) *each week, and upgrade to a* [*premium subscription*](https://securinglaravel.com/#/portal/signup) *to receive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or toss a coin in the* [*tip jar*](https://securinglaravel.com/#/portal/support)*.*

*Reach out if you're looking for a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*, and find me on the various socials through* [*Pinkary*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. Finally, don't forget to check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive security course.*