The .well-known/security.txt File That 80% of Projects Are Missing

Of the 30 open-source projects in our Security Headers benchmark, 21 do not have a security.txt file. That is 70% — and the real number across all web projects is almost certainly higher.

The check is security-headers.basic-hygiene.security-txt. It is weighted as "info" severity, which means it contributes minimally to the overall score. But its practical importance is inversely proportional to its weight. A missing security.txt does not make your app insecure. It makes your app harder to secure when someone finds a vulnerability.

What security.txt is

RFC 9116 (published 2022, replacing the earlier draft from 2017) defines a standard file at /.well-known/security.txt that tells security researchers how to report vulnerabilities in your project. That is it. It is a plain text file with contact information.

Before this standard existed, a researcher who found a vulnerability in your app had to guess: Do I email info@? Do I file a GitHub issue (publicly disclosing the vulnerability)? Do I DM someone on Twitter? Do I just publish it?

Many researchers give up. Some publish. Neither outcome is good for you.

Who has it, who does not

Projects with security.txt (9 of 30):

• Documenso
• Dub
• Midday
• Supabase
• Plane
• Cal.com
• Infisical
• Saleor
• Medusa

Projects without security.txt (21 of 30): The other 21, including well-known projects like Hoppscotch, Formbricks, Appsmith, PostHog, Novu, Strapi, Directus, Typebot, and many more.

Some of these projects have a SECURITY.md file in their GitHub repository — which is good practice for open-source projects. But SECURITY.md lives in your repo. security.txt lives at a well-known URL on your deployed application. A researcher scanning your production site will find the latter. They will not check your GitHub.

Why it matters more than its weight suggests

The security.txt check is weighted as "info" severity (weight: 1, compared to 10 for critical and 3 for high/medium). That weighting is correct from a scoring perspective: missing security.txt does not directly create a vulnerability. But consider the failure mode:

1. Researcher finds XSS vulnerability in your app
2. Researcher looks for /.well-known/security.txt — not found
3. Researcher checks for a SECURITY.md — maybe finds it, maybe does not
4. Researcher emails a generic contact address — maybe monitored, maybe not
5. Researcher waits 90 days per responsible disclosure norms
6. Researcher publishes