security.txt: Proposed standard for defining security policies

security.txt A proposed standard which allows websites to define security policies. Summary “When security risks in web services are discovered by independent security researchers who understand the severity of the risk, they often lack the channels to disclose them properly. As a result, security issues may be left unreported. security.txt defines a standard to help organizations define the proce

[YassLab]

ell-known/security.txt) [RFC8615][Security][セキュリティ][security.txt]. It can also be placed in the root directory (/security.txt) of a website, especially if the /.well-known/ directory cannot be used for technical reasons, or simply as a fallback"

[criticabug]

脆弱性をカジュアルに公開報告されたくなかったらサイト運営者はこういうURLを用意しておくんだよ

[y-kawaz]

こんなんあったんか

[efcl]

セキュリティの連絡先のRFC

[yosuke_furukawa]

security.txt 啓蒙サイトあるのね

[tmatsuu]

セキュリティ専門家に脆弱性の報告先を告知するため、webサイトに/security.txtを設置する案らしいが、自分は否定的だなー。*.txt増えすぎでしょ

[mergyi]

“Security.txt defines a standard to help organizations define the process for security researchers to securely disclose security vulnerabilities.”