Expired security.txt

With no file, a reader finds a contact the usual way — a support form, a general address. Slow, and it works.

With an expired file, they are told the information is stale, which is a reason to give up rather than a route to try.

If they write anyway, the address is frequently a role that no longer exists or a person who left.

So the file converts a slow success into a likely failure, which is the inversion that makes this worth fixing rather than ignoring.

The expiry mechanism is working correctly when this happens — it is telling you something, and the something is that nobody has looked in a year.

A contact address published once carries no information about whether it is still monitored.

Without a date, a reader cannot distinguish a file maintained last month from one written four years ago.

The specification therefore makes the field mandatory rather than optional, which is unusual and deliberate.

It also means the file requires ongoing attention, which is the point: a security contact nobody maintains is not a security contact.

A date roughly a year ahead, renewed as part of whatever annual review already exists, is the practical pattern.

Confirm the contact is a role address rather than an individual's, so it survives someone leaving.

Confirm it is monitored — an address that reaches an unread mailbox is the same failure with a valid date.

Check the file is served from the conventional well-known location, since automated tooling looks only there.

Add a link to a disclosure policy if there is one, so a reader knows what to expect before writing.

Serve it from the root location as well for compatibility, which costs nothing.

Put the renewal in the same calendar as certificate and domain renewals, which are the other dates that expire quietly.

Or generate the file as part of a build, with the expiry computed from the build date — which keeps it current as long as you deploy.

Monitor it the way you monitor a certificate: an alert on the remaining validity rather than on a process.

Renew well before the date rather than on it, since the file is cached by whoever fetched it.

It does not make the site more secure, and it is not meant to.

It changes what happens after someone notices something: they have a documented address instead of a reason to go elsewhere with it.

It also sets expectations, particularly where a disclosure policy is linked.

Which is why a stale file is a real defect rather than cosmetic: the mechanism exists for one moment, and that moment is when it has to work.

Fetch the file from the well-known path and read the expiry field.

A date in the past is the defect. A missing field is a different defect with the same consequence.

Confirm the contact field is present, since a file without one is unusable regardless of its date.

Send a test message to the address and confirm someone receives it.

Check the root location too, since some readers look there first.

`exposure.security_txt.expired` checks whether the expiry date has passed, which is this problem directly.

`exposure.security_txt.present` and `exposure.security_txt.location` report whether the file exists and whether it is at the canonical path.

`exposure.security_txt.fields` validates the required contact and expiry fields.

`exposure.security_txt.policy` reports whether a disclosure policy is referenced.

`quality.security_txt` reports the overall posture across those, and `exposure.well_known.change_password` covers the neighbouring conventional file.

Automated tooling fetches it from the well-known path and parses the contact field, which is why the location matters as much as the content.

A researcher reads it before writing, and the policy link is what tells them whether a report will be welcomed and on what terms.

A preferred-languages field, where present, tells them which language to write in — a small courtesy that measurably improves the quality of reports.

An encryption key field lets a sensitive report be sent encrypted, which matters for the reports worth receiving most.

None of those fields is required, and each of them makes the file more likely to be used rather than skipped.