Why having a security.txt matters
One day, not so long ago on a Sunday afternoon I was out for a walk with my wife going past a local florist. Its somewhere that I know quite well, popping in there every week or two to get fresh flowers for the house. This day happened to be a Sunday afternoon and the florist was shut but a new ornament in the window caught my eye. A life-sized, hyper realistic thrush was new in the display staring back at me. It was especially notable because they didn’t have anything else quite like that in the store and the detail on it was impressive. I stood there admiring it a moment wondering why the owner had opted for something so out of place yet so well made and trying to work out what it was made of.
And then it moved.
The poor thing had been trapped in there who knows how long and was exhausted. It had given up on trying to escape after an unknown number of attempts and relegated itself to staring out at the people passing by. What do you even do in this situation?
There was no-one around to open up the store to let the bird out, the phone number was a direct line to the vacant store, and given the state of the bird it was unknown if it would survive the night. Well, I reached out on Instagram and hoped that the owner would respond in time. 1 hour later I had a response and the owner of the store was on the way.
Be it physical or online, existence means that you or your business are going to be thrown curveballs. The owner of the florist never expected to have to save a bird on a Sunday afternoon, but the consequences of not doing that would almost certainly have been a nasty way to start the week. While you can’t know what’s on the way, you can make sure that good samaritans have a way to let you know. That’s where a security.txt comes in. It tells people how to contact you when needed and where key details are about things that you’re interested in.
Yes, it’s yet another way to contact you and you no doubt have plenty of those already but this one’s a little different. Thinking back to the bird, the florist had plenty of ways to be contacted but only due to a dedicated business owner checking their business profile’s messages on a Sunday was the bird able to be noticed quickly. And being honest, even looking at the state of the bird and wanting to do the right thing, the unlikeliness of success from a social media message did cause me to want to just be another person who had walked past that day. That’s why a security.txt shines. It’s a banner that you do actually care. It invites people to do the right thing and even makes it easy for them. It even takes almost no effort to implement!
There are other benefits too. Since it is so visible it can help your clients have a little more confidence that you do actually take security seriously and they’re not just a bunch of words on your page. That can lead to:
- The potential customer’s security team giving your proposal the green light.
- Easier responses to compliance and insurance questionnaires.
- Your business or community feeling more confidence in your application or service.
- More evidence of doing the right thing if something goes wrong, like a notifiable privacy breach.
- Security researchers having a good experience rather than dragging your reputation through the mud in online discourse.
It’s easy to implement.
- Use our free generator to get yourself a template.
- Check to see if you need to modify it to suit your site.
- Make sure the contact details are working.
- Host it on your domain at /.well-known/security.txt
That’s it. As long as you keep the contact method working and file online, people can contact you and you’re effectively done. With that step completed you can then look at things like Vulnerability Disclosure Policies (you will have also seen that option on the generator page) when you’re ready.
While you’re getting that done, I’ll be working on putting some words around what comes next.
So what happened to the bird in the end? Well, I don’t actually know. Despite buying many flowers since then I’ve never actually asked the owner. But, I’ve sent this blog post to the owner of the store and will keep everyone updated if there’s a response.