Measurements by Germany's Federal Office for Information Security (BSI) as part of the Cyberdome project show that only 1.8 percent of German websites provide a Security.txt file. Setting it up takes barely any effort, and given upcoming obligations under the Cyber Resilience Act, a fixed reporting channel for vulnerabilities is becoming increasingly important.
A missing contact costs time
The file specifies how security researchers, CERTs, and other reporters can reach the right contact for vulnerability reports. Without such an entry, reports sometimes end up with the wrong people, which can delay handling or even mean a tip never gets followed up at all. For anyone running a website, Security.txt is therefore a simple but effective building block of vulnerability management.
In the Cyberdome project, the file acts as a link between automated checks and the companies responsible. Cyberdome scans websites, identifies possible security weaknesses, and forwards the results to the contact listed in Security.txt. That lets operators respond faster and fix vulnerabilities.
Low effort, clear requirements
The technical implementation comes down to just a few details. Required are a specific contact for security reports, an expiration date for the file, and hosting it at /.well-known/security.txt. That satisfies the core requirements of RFC 9116, the standard behind Security.txt. It defines a machine-readable text format that lets website operators and companies publish their contact details for vulnerability disclosure in one fixed location.
That makes the measure one of the simpler ways to improve how externally reported vulnerabilities get handled. What still matters, though, is that the listed contact is actually reachable and that reports get processed internally. A file alone doesn't eliminate vulnerabilities, but it does prevent important tips from failing simply because the communication channel was missing or hard to find.
Regulatory pressure is rising
A reliable reporting channel is also gaining importance from a regulatory standpoint. The Cyber Resilience Act (CRA) sets binding requirements for handling vulnerability reports and becomes fully mandatory starting December 2027. Reporting obligations for actively exploited vulnerabilities and severe security incidents already apply from September 11, 2026. Security.txt doesn't replace these obligations, but it can help receive security reports early and route them within the organization. That gives companies a comparatively low-effort way to start preparing for the stricter requirements now. The BSI and the Alliance for Cyber Security are therefore actively promoting the setup of a Security.txt and provide informational material to support it.