Add a security.txt file in ten minutes
RFC 9116 needs three lines. Annex I Part II will require a disclosure contact from 11 December 2027. Here's how researchers use the file.
Three lines, one file
A security.txt file lives at /.well-known/security.txt. RFC 9116 sets the format. A Contact line with an email or URL and an Expires date are required. A Canonical URL that points back to the file itself is recommended, not required.
Ten minutes: pick a contact address, pick an expiry a year out, upload the file. That's the whole job. No framework, no build step, no approval chain.
What Annex I asks for later
The Cyber Resilience Act adds a heavier requirement on top of the file. Annex I, part II, points 5 and 6 list a coordinated vulnerability disclosure policy and a contact address among the essential requirements. Those apply from 11 December 2027, along with the rest of annex I (article 71). Fines for missing them start the same day, under article 64.
The regulation asks for more than a contact address. It wants a documented process behind it: who triages a report, how long a fix takes, and how you tell affected users. The file gives researchers the one line they need to start: where to send the report. Writing it now means that line already exists when the rest of the policy has to.
Why researchers check for it first
Take a one-person SaaS with a public API. A researcher finds an authentication bypass, checks /.well-known/security.txt for a contact, finds nothing, and posts about it instead of emailing anyone. No malice in that. Scanners look for the file automatically, and researchers who triage many reports a week skip products that don't have one.
A working security.txt turns a stranger with a real finding into a report in your inbox instead of a thread on social media. That value holds independent of what the regulation will eventually require.
Start with the file, build the policy after
The file takes ten minutes. The policy behind annex I, part II takes longer, and it stands apart from a separate duty. Article 14 already sets a 24 h / 72 h notification clock from 11 September 2026, running from the moment you know a vulnerability is actively exploited. Article 14, paragraph 8 adds a duty to tell affected users. No fine attaches to article 14 yet: that starts 11 December 2027 too, under article 64.
CRA Kit's kit page has a security.txt template and a disclosure policy skeleton to start from: https://crakit.eu/kit/
Not legal advice.
This is not legal advice.