# Security.txt

### Summary
>  When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.

Source: https://tools.ietf.org/html/draft-foudil-securitytxt-09

The Magento_Securitytxt module provides the following functionality: 
* allows to save the security configurations in the admin panel
* contains a router to match application action class for requests to the `.well-known/security.txt` and `.well-known/security.txt.sig` files.
* serves the content of the `.well-known/security.txt` and `.well-known/security.txt.sig` files.

A valid security.txt file could look like the following example:

```
Contact: mailto:security@example.com
Contact: tel:+1-201-555-0123
Encryption: https://example.com/pgp.asc
Acknowledgement: https://example.com/security/hall-of-fame
Policy: https://example.com/security-policy.html
Signature: https://example.com/.well-known/security.txt.sig
```
Security.txt can be accessed at below location:
`https://example.com/.well-known/security.txt`

To create security.txt signature (security.txt.sig) file:

`gpg -u KEYID --output security.txt.sig --armor --detach-sig security.txt`

To verify the security.txt file's signature:

`gpg --verify security.txt.sig security.txt`