security.txt (RFC 9116)

An RFC that helps organisations define security policies by @EdOverflow & @nightwatchcyber.

👉

[so long and thanks for the phish @ant0inet]

🚨 BREAKING 🚨

Our @securitytxt 2024 version is updated containing a new CTF-like challenge. Check it out now: https://t.co/Jr5lW7Fqtr

[Alex Chapman @ajxchapman]

This is probably the best public Vulnerability Disclosure Program terms I've ever seen. It demonstrates the exact nature of a VDP, "see something, say something" no more, no less. +10 for hosting a @securitytxt file too. Nice work @ServiceNow 👏

[security.txt (RFC 9116) @securitytxt]

🇯🇵

[JPCERTコーディネーションセンター @jpcert]

JPCERT/CC Eyes「RFC 9116「security.txt」の紹介（2022年8月）の続報」を公開。RFC 9116のおかげで開発者との脆弱性関連情報のコーディネーション（調整）が大変スムーズにできた事例と、「security.txt」の紹介記事についてご紹介します。^KI
https://t.co/WZMV622Teb

[security.txt (RFC 9116) @securitytxt]

https://t.co/c19MijmKHZ

[Troy Hunt @troyhunt]

Looking for a little project to keep you busy on the weekend? I was just thinking: how many of the breached websites in @haveibeenpwned now have a security.txt file? So, if you feel like grabbing those domains and querying them all, there's an API here: https://t.co/ftiKkfH7Hp

[so long and thanks for the phish @ant0inet]

Switzerland's largest retail company @migros published their vulnerability disclosure policy via @securitytxt 🥳

[Troy Hunt @troyhunt]

This is great: having a security.txt file is now mandatory for Dutch government websites. They either need to apply this as a standard or provide a good justification for why they're not using it ("Apply of Explain") https://t.co/Q99eDiR1AW

[ForumStandaardisatie @openstandaarden]

security.txt 📑 has been added to the 'Comply or Explain' list of the Netherlands Standardisation Forum. This means that Dutch municipalities, provinces, the state, water boards and all operational organisations are obliged to apply this open standard.✅https://t.co/LPeSFMmQAc

[security.txt (RFC 9116) @securitytxt]

@HttpSecHeaders @CISAgov Awesome to see this! Unfortunately, the incorrect RFC ID was referenced. It should be RFC 9116. :(

[security.txt (RFC 9116) @securitytxt]

Bridge the gap between your website and security researchers. ✅ Implement security.txt and promote coordinated vulnerability disclosure.

Need help getting started?

➡️ Head on over to https://t.co/cVAwRS9qdi.

#securitytxt #cybersecurity

[Caleb Queern @HttpSecHeaders]

@securitytxt nice recommendation for security.txt in this @CISAgov advisory https://t.co/jXo0mrTGQn

[security.txt (RFC 9116) @securitytxt]

That needed an update. 👀

[security.txt (RFC 9116) @securitytxt]

Exciting news! @Apple joins the list of companies with a security.txt file. Now, we only need @netflix to complete the FAANG list. 🙌

[rfceditor @RFCEditor]

Can you spare an hour to help us improve https://t.co/G5RrCkieuU (the official home of RFCs)? If you’ve used RFCs for work, school or research, we’d love to learn from you - particularly if you're new here! Volunteer by answering a few quick questions: https://t.co/ifQZAe0OQU

[Pen Test Partners @PenTestPartners]

A tale of Google dorks finding subdomain takeovers plus why having a security.txt & a responsive security team are good news all round. London Councils & pirate books. Google dorking for subdomain takeovers. Thanks to our @OPSEC_failed
https://t.co/msCkRLzeZQ
#cybersecuritytips

[Internet.nl | @[email protected] @internet_nl]

Check out the just released fresh version of https://t.co/brl6s4Llhm with improved tests for CSP and security.txt, https://t.co/kWnTE39dX4

Happy testing and improving!

#moderninternet

[security.txt (RFC 9116) @securitytxt]

@oh2fih also wrote a Bash helper script to generate RFC 9116-compliant security.txt files.

https://t.co/Su665PvMNk

[security.txt (RFC 9116) @securitytxt]

🇫🇮 Shout-out to @oh2fih who wrote their Master's thesis on security.txt adoption on .fi domains.

https://t.co/dQATNoD9pP

[security.txt (RFC 9116) @securitytxt]

Where did you first hear about security.txt?

[security.txt (RFC 9116) @securitytxt]

@Jester0x01 @rez0__ @OpenAI Now on the main website too: https://t.co/C9IWODZdUA. :)

[security.txt (RFC 9116) @securitytxt]

@Jester0x01 @rez0__ @OpenAI https://t.co/lWTSvXgUNI