./cra/security.txt --generate
security.txt and disclosure policy
The CRA expects every manufacturer to have a coordinated vulnerability disclosure policy and a contact address for reporting vulnerabilities. A security.txt file is the standard way to publish that contact, and this page writes both for you.
- Add at least one contact. It is the only field besides Expires that security.txt requires.
security.txt
Publish this as plain text at /.well-known/security.txt on your domain. Contact and Expires are required, and Expires should be less than a year ahead, so put a reminder in your calendar to renew it. Signing the file with OpenPGP is recommended.
Contact: mailto:security@example.com
Expires: 2027-01-01T23:59:59Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security/policy
Coordinated vulnerability disclosure policy
A starting template. Adapt it to how your team really works and have it reviewed before you publish it, especially the part about legal action.
# Security vulnerability disclosure policy
Our company takes the security of its products seriously. If you believe you have found a security vulnerability in one of our products or services, we want to hear from you.
## How to report
Email security@example.com with a description of the issue, the affected product and version, steps to reproduce it and, if possible, a proof of concept. Our current contact details are always listed at https://example.com/.well-known/security.txt.
Please do not access, modify or delete data that does not belong to you, do not degrade our services or devices in the field, and give us reasonable time to fix the issue before disclosing it publicly.
## What you can expect from us
We will acknowledge your report within 5 business days and keep you informed while we investigate and fix it. We will agree a disclosure timeline with you and, if you wish, credit you once the fix is released.
Once a security update is available, we publish information about the fixed vulnerability so users can check whether they are affected and how to update. If a vulnerability in our products is being actively exploited, we notify the authorities as required by the EU Cyber Resilience Act.
## Good faith
We will not pursue legal action against anyone who reports a vulnerability in good faith and follows this policy.
## Scope
This policy covers Our company products, their firmware and the online services they depend on. Vulnerabilities in third-party components are welcome too, and we will coordinate with the maintainers of those components.
Follows RFC 9116 for security.txt and Annex I Part II of the CRA for vulnerability handling. The policy text is a template, not legal advice.