Chapter 70: Permissions Policy & Modern Security Headers

The security.txt Standard (RFC 9116)

**Part 14: Security & Best Practices** — Chapter 70: Feature Policy & Permissions Policy

LEARNING OBJECTIVES ⌵
  • Understand RFC 9116 standardizing /.well-known/security.txt.
  • Define vulnerability disclosure channels (Contact email, PGP encryption key, Bug Bounty policy).
  • Implement mandatory expiration timestamps (Expires: YYYY-MM-DD...).
  • Publish an authoritative, cryptographically signed security disclosure policy.
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

Complete Production /.well-known/security.txt

# RFC 9116 Security Vulnerability Disclosure Policy
Contact: mailto:[email protected]
Contact: https://example.com/security/report
Encryption: https://example.com/pgp-key.txt
Acknowledgements: https://example.com/security/hall-of-fame
Policy: https://example.com/security/policy
Hiring: https://example.com/careers
Canonical: https://example.com/.well-known/security.txt
Preferred-Languages: en, es, de
Expires: 2027-12-31T23:59:59.000Z

📌 Key Takeaways

  • security.txt is the standardized location where ethical security researchers find your contact information to disclose vulnerabilities responsibly.
  • Always include an Expires field, as RFC 9116 requires researchers to ignore expired files.
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?

🏋️ Study Exercise

Task: Review the text example above. Identify the key directives and their purpose, then try writing your own version from memory.

# RFC 9116 Security Vulnerability Disclosure Policy Contact: mailto:[email protected] Contact: https://example.com/security/report Encryption: https://example.com/pgp-key.txt Acknowledgements: https://example.com/security/hall-of-fame Policy: https://example.com/security/policy Hiring: https://example.com/careers Canonical: https://example.com/.well-known/security.txt Preferred-Languages: en, es, de Expires: 2027-12-31T23:59:59.000Z