No security.txt — no contact for vulnerability reports

Whoever finds a vulnerability in your app needs to know whom to tell. security.txt (RFC 9116) is the standardised place for that: a text file with a contact address and an expiry date. Security researchers, scanners and CERTs look there first.

The EU Cyber Resilience Act requires a reachable contact for vulnerability reports for products with digital elements; the German BSI recommends security.txt as the implementation. This is a technical classification, not legal advice — whether the CRA applies to your product is a question for your counsel. The file itself takes five minutes.

Check it yourself: `curl -si https://your-domain.com/.well-known/security.txt` — a 200 with a `Contact:` line is the goal. A 404 means the file is missing. Only a real 404 is reported; a site answering every path with 200 does not get this finding.