infoSeverity: infoRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Static file · /.well-known/Where it livesImplementationThis fix is applied in: Static file · /.well-known/. That's the surface you'll edit, DNS, response headers, or a static file.~3 minTime to fixEffortRoughly 3 minutes of hands-on work, propagation aside. Most of these are copy-paste.+1 posture+1 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

security.txt: give researchers a way to reach you

Publish a security contact before you need one

The threat

When a good-faith researcher finds a hole in your site, they need somewhere to tell you. With no security.txtsecurity.txtDisclosureAn RFC 9116 standard file at /.well-known/security.txt that publishes how a researcher should report a vulnerability to you., they guess at info@, give up, or, worst case, post it publicly. A security.txtsecurity.txtDisclosureAn RFC 9116 standard file at /.well-known/security.txt that publishes how a researcher should report a vulnerability to you. file (RFC 9116) is the agreed-upon place to publish your security contact, so reports reach the right inbox fast and quietly.

The exact fix

Add a plain-text file that deploys to https://yourdomain.com/.well-known/security.txt. On a static host (Netlify, etc.), put it at public/.well-known/security.txt in your repo:

Contact: mailto:security@yourdomain.com
Expires: 2027-06-27T00:00:00Z
Preferred-Languages: en
Canonical: https://yourdomain.com/.well-known/security.txt

Contact and Expires are required by the spec. Keep Expires within a year and refresh it.

Verify it

curl -sI https://yourdomain.com/.well-known/security.txt | head -1

Expected:

HTTP/2 200

Proof

A three-minute static-file add on dev3lop.com, live at /.well-known/security.txt, closed the finding and rounded out a flawless 100 / grade A scorecard.