A standardized doorway for vulnerability reports

Security researchers who find a flaw in your website face an immediate obstacle: figuring out who to tell. Without a published, standard location for disclosure instructions, reports get delayed or lost entirely. security.txt solves that by giving organizations a predictable file path where researchers can find contact details and disclosure policies. It is defined in RFC 9116 and has become a de facto standard among security-conscious organizations.

Cloudflare first shipped an open-source Worker for this purpose back in 2020, but managing it required deploying and maintaining code. To lower that barrier, the tool is now built directly into the Cloudflare dashboard as a free generator for any user who manages a website. The goal is straightforward: let site owners adopt the standard without needing to be security specialists or write a single line of code.

How the generator works

The feature does not produce a static file at the moment you save your settings. Instead, it operates dynamically:

When you enter your data in the Cloudflare Dashboard, the information is stored in a highly available, geo-redundant PostgreSQL database. When a request arrives for the .well-known path specified by the RFC, Cloudflare constructs the file on the fly using the most recent database contents. That means edits reflect in real time, with no file regeneration or manual intervention required on your part.

Updates propagate through Cloudflare’s global network using its Quicksilver technology, which rapidly synchronizes configuration across all servers. Changes to a security.txt file are therefore available almost immediately from anywhere in the world.

Each generated file includes an expiration timestamp that you set during initial configuration. This is intended to act as a reminder: if you choose, say, 365 days out, you will receive notifications as that date approaches, prompting you to verify that your contact details and policies are still current.

For organizations that want more assurance, the generator supports optional fields for encryption keys and signatures. You can link to your PGP keys for secure communications, or include a signature to let researchers verify the file’s authenticity.

Automation and visibility

Site owners who prefer programmatic control can manage their security.txt files through the Cloudflare API, which allows seamless integration with existing workflows and CI/CD pipelines. No manual dashboard interaction is required for those who want to script configuration changes.

Administrators can also check on their disclosure posture from a different angle: Security Insights, under the Security Center, will flag any missing security.txt files across your zones, so gaps in coverage are easy to spot.

The feature is available now, at no cost, to all Cloudflare users.