When someone finds a flaw in your app, their first problem is knowing who to tell. With no obvious contact, reports go to a general support inbox and get lost, get posted publicly, or are never sent at all. A security.txt file gives a well-known place to look, for people and for automated tools.
The format is plain text with one field per line. Two fields are required: Contact, which is an email address or a web page for reports, and Expires, a date after which the file should be considered stale. Optional fields include Policy for a link to your disclosure policy, Preferred-Languages, Canonical and Encryption. The file must be served over HTTPS.
For a small team this takes a few minutes and costs nothing. Use a shared address such as security@ in place of a personal one, make sure someone actually reads it, and update the Expires date before it passes. Publishing the file does not commit you to paying bounties. It only tells people where to send a report.
Contact: mailto:security@your-domain.com
Expires: 2027-12-31T23:59:59Z
Preferred-Languages: en
Canonical: https://your-domain.com/.well-known/security.txt