Security.txt Checker

Check websites for security.txt file (RFC 9116). Find contact info, encryption keys, and compliance issues.

What does Security.txt Checker do?

This actor checks websites for a security.txt file as defined by RFC 9116. It looks in /.well-known/security.txt and /security.txt, parses contact information, encryption keys, expiration dates, and validates compliance with the standard.

The actor reports whether the file exists, its exact location, all parsed fields (contact, encryption, acknowledgments, policy, hiring, preferred languages), PGP signature status, expiry validation, and any compliance issues found. Use it for security audits, vulnerability disclosure research, or monitoring your own domains.

Use cases

• Security auditing -- verify that security.txt files exist and are valid across your organization's domains
• Vulnerability disclosure -- find contact info for responsible disclosure before reporting security issues
• Compliance monitoring -- check RFC 9116 compliance across domains to ensure your security contact information is standards-compliant
• Bug bounty research -- discover bug bounty programs, security policies, and hiring pages from security.txt entries
• Vendor assessment -- evaluate the security posture and transparency of third-party services and SaaS providers

Why use Security.txt Checker?

• Batch checking -- scan hundreds of domains in a single run to audit your entire portfolio or vendor list
• Structured output -- get clean JSON with all parsed fields, compliance issues, and expiry status ready for analysis
• RFC 9116 validation -- automatically checks for required fields, proper formatting, and expiration dates per the specification
• API access -- integrate security.txt monitoring into your security dashboard or GRC platform
• Pay-per-event pricing -- only pay per domain checked with no monthly fees
• Dual path support -- checks both /.well-known/security.txt (preferred) and /security.txt (legacy) locations

Input parameters

Parameter	Type	Required	Default	Description
urls	array	Yes	--	List of website URLs or domains to check for security.txt. URLs are automatically cleaned to extract the domain.

Example input

{
    "urls": [
        "https://www.google.com",
        "https://github.com",
        "https://www.facebook.com"
    ]
}

Output fields

Each domain produces one record with the following fields:

Field	Description
url	The original URL provided in the input
domain	The extracted domain name
hasSecurityTxt	Whether a security.txt file was found
location	The full URL where security.txt was found
contact	Array of contact URLs or email addresses
expires	The Expires field value as an ISO 8601 timestamp
isExpired	Whether the security.txt file has expired
encryption	Array of encryption key URLs
acknowledgments	URL to the acknowledgments page, if specified
preferredLanguages	Preferred language codes from the file
canonical	The canonical URL of the security.txt file
policy	URL to the security policy page
hiring	URL to the security hiring page
isSigned	Whether the file has a PGP signature
issues	Array of RFC 9116 compliance issues
error	Error message if the check failed, null otherwise
checkedAt	ISO 8601 timestamp of the check

Output example

{
    "url": "https://github.com",
    "domain": "github.com",
    "hasSecurityTxt": true,
    "location": "https://github.com/.well-known/security.txt",
    "contact": ["https://hackerone.com/github"],
    "expires": "2026-06-01T00:00:00.000Z",
    "isExpired": false,
    "encryption": [],
    "acknowledgments": null,
    "preferredLanguages": "en",
    "canonical": "https://github.com/.well-known/security.txt",
    "policy": "https://docs.github.com/en/site-policy/security-policies",
    "hiring": "https://github.com/about/careers",
    "isSigned": true,
    "issues": [],
    "error": null,
    "checkedAt": "2026-03-01T12:00:00.000Z"
}

How much does it cost?

Security.txt Checker uses Apify's pay-per-event pricing. You only pay for what you use.

Event	Price	Description
Start	$0.035	One-time per run
Domain checked	$0.001	Per domain checked

Cost examples:

• 10 domains: $0.035 + 10 x $0.001 = $0.045
• 100 domains: $0.035 + 100 x $0.001 = $0.135
• 1,000 domains: $0.035 + 1,000 x $0.001 = $1.035

Using the Apify API

You can start Security.txt Checker programmatically using the Apify API. Replace YOUR_TOKEN with your Apify API token.

Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_TOKEN' });
const run = await client.actor('automation-lab/security-txt-checker').call({
    urls: ['https://github.com', 'https://www.google.com'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python

from apify_client import ApifyClient

client = ApifyClient('YOUR_TOKEN')
run = client.actor('automation-lab/security-txt-checker').call(run_input={
    'urls': ['https://github.com', 'https://www.google.com'],
})
items = client.dataset(run['defaultDatasetId']).list_items().items
print(items)

Integrations

Connect Security.txt Checker with other tools using Apify integrations. Export results to Google Sheets for security posture tracking, send Slack alerts when a security.txt file expires or goes missing, trigger Make or Zapier workflows for automated vendor security assessments, push data to n8n, or configure webhooks for real-time monitoring.

Tips and best practices

• Monitor expiry dates by scheduling regular runs -- RFC 9116 requires an Expires field, and expired files indicate unmaintained security contacts.
• Check the isSigned field to verify whether the security.txt has a PGP signature, which adds authenticity to the contact information.
• Review the issues array for RFC compliance problems such as missing required Contact or Expires fields.
• Use for vendor onboarding by checking if new vendors have a security.txt as a baseline indicator of security maturity.
• Combine with SSL Certificate Checker to build a comprehensive security posture overview for each domain.

FAQ

What is security.txt? Security.txt is a proposed standard (RFC 9116) that allows websites to define security policies and contact information in a machine-readable format at /.well-known/security.txt. It helps security researchers find the right contact for vulnerability reports.

What does the isExpired field mean? RFC 9116 requires a mandatory Expires field. If the current date is past the expiry date, isExpired is true, meaning the file is stale and the contact information may be outdated.

Does this actor validate PGP signatures? The actor detects whether the security.txt file is PGP-signed (the isSigned field) but does not cryptographically verify the signature against a public key.