A File Format to Aid in Security Vulnerability Disclosure
RFC 9116, “A File Format to Aid in Security Vulnerability Disclosure”, is an Informational document published in April 2022 by E. Foudil, Y. Shafranovich. The canonical text is published by the RFC Editor.
Abstract
When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.
What “Informational” means
Published for the general information of the community. It does not define an IETF standard and carries no standards-track status.
The canonical text of RFC 9116 is hosted at rfc-editor.org. Available in HTML,TXT,PDF,XML.