Security.txt VDP Checker - Disclosure Evidence API
Pricing
from $1.00 / 1,000 security.txt and vdp reports
Security.txt VDP Checker - Disclosure Evidence API
Check public security.txt files and vulnerability disclosure pages for contacts, expiry, policy, encryption, and bug bounty platform evidence.
Pricing
from $1.00 / 1,000 security.txt and vdp reports
Rating
0.0
(0)
Developer
Sean J
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
3 days ago
Last modified
Categories
Share
What does Security.txt VDP Checker do?
Collect public disclosure-channel evidence before a manual security-program review. This Actor checks security.txt and disclosure-related pages for contact, expiry, policy, encryption and bug-bounty references. Open the Actor to inspect its input and pricing.
Start with one website
- Paste one public URL into the Input tab, preferably the relevant policy or resource page.
- Keep evidence enabled and set a run spending limit that covers both event fees below.
- Run the check, then inspect its sources and errors before expanding the list.
Example input with one public source URL checked on 27 October 2026. Current responses and coverage may differ:
Read the evidence
Inspect the returned field values and their original source before relying on a contact or policy. A detected disclosure page does not establish the programme’s scope, safe-harbour terms or whether a report will be accepted.
| Field | How to use it |
|---|---|
status, confidence | Signal-detection status and a heuristic score, not a probability of correctness. |
extracted.securityTxt | Detected security.txt values for manual source review. |
findings | Short source snippets when includeEvidence is enabled. |
coverage, errors | Request/download limits and problems affecting what was checked. |
Export JSON or CSV with retrievedAt and your source notes so a later comparison retains its original context.
Scope and limits
This is not a vulnerability scan, a complete RFC 9116 conformance check or permission to test a website. Missing signals in a bounded check do not prove that a disclosure programme is absent.
Checks use static public responses, without browser execution or login. Each site is bounded by 20 seconds, 1 MiB downloaded and 4 MiB decoded text; redirects and failed requests consume maxPagesPerSite attempts. Submit at most 100 combined URL/domain entries, including duplicates. An undetected signal is not proof of absence.
Pricing and spending control
Event fees are $0.002 per attempt (website-processed) plus $0.001 per useful report (vdp-report): $0.003 when both apply. Check the Pricing tab for the current rates. The report fee requires FOUND or PARTIAL with useful detected signals or extracted evidence. Failed or empty resource probes do not qualify; ordinary NO_SIGNAL/FETCH_FAILED output incurs only the attempt fee.
Budget for both fees before starting a website, and check the Pricing tab for platform terms and plan charges. Review RUN_SUMMARY before repeating billing/output uncertainty, because a retry is a new chargeable check.
Responsible use and support
Use permitted public targets and review their terms. Send a sanitized input through the Issues tab for support or a scope discussion.
