CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A company implements a 'security.txt' file at '/.well-known/security.txt'. What is this file's purpose and what should it contain?
- A.security.txt stores the server's TLS certificate fingerprints
- B.security.txt is a browser security policy file like robots.txt
- C.security.txt (RFC 9116) provides security researchers and bug hunters with information about how to report vulnerabilities: a contact email/URL, a PGP key for encrypted reports, disclosure policy URL, acknowledgments page, and expiry date. This helps ethical hackers know where to responsibly disclose vulnerabilities before resorting to public disclosure
- D.security.txt lists all security headers the site uses
Why C is correct
security.txt (RFC 9116) is an industry standard file that organizations publish to facilitate responsible vulnerability disclosure. It answers: 'How do I report a security issue I found?' Key fields: Contact (reporting channel), Expires (file validity date), Encryption (PGP key for encrypted reports), Acknowledgments (recognition page), Policy (disclosure policy URL), Preferred-Languages. Without security.txt, researchers may not know where to report or may resort to public disclosure. It reduces the friction for responsible disclosure programs.
Know someone studying for Web App Fundamentals? Send them this one.