What it is
security.txt tells researchers how to report a security problem. RFC 9116 defines the format: a contact address and an expiry date at minimum, then optionally a disclosure policy, a PGP key and preferred languages. It belongs at /.well-known/security.txt.
Why it matters
Without a published contact, whoever finds a vulnerability either gives up or reports it somewhere public. The file is informative in its own right: a current, complete one suggests a team that expects reports, and the PGP key carries metadata of its own.
How this assessment works
Skopeon Labs queries public infrastructure signals and authoritative network protocols directly from external sensor nodes. All evaluations are completely non-invasive and agentless, assessing observable configurations without sending malicious payloads or disrupting service.
Operational Scope & Limitations
This check evaluates public perimeter responses observable at the time of inquiry. Endpoints protected behind third-party reverse proxies or CDNs reflect the edge configuration of the proxy layer.