Does Your Organization Have a Security.txt File?

Brian Krebs' article on security.txt files - a proposed internet standard helping organizations provide clear channels for security vulnerability reporting. The file is placed at standard locations like 'example.com/security.txt' or 'example.com/.well-known/security.txt' and provides contact email addresses for security matters and links to vulnerability disclosure policies. Benefits include making it easier for researchers to report issues, providing standardized communication channels, and helping organizations receive critical vulnerability notifications. Challenges include potential for 'low-quality vulnerability scan reports' and spam from automated tools. As co-author Edwin Foudil notes, 'It's been an incredible success with universities, which tend to have lots of older, legacy systems.' Currently about 8 Fortune 100 companies have adopted this including Alphabet, Amazon, and Facebook.