# Security.txt Auditor (`phoenix2810/security-txt-auditor`) Actor Audit a public website's security.txt vulnerability disclosure metadata. Checks discovery paths, required fields, expiration, contact methods, and returns a readiness score with recommendations. - **URL**: https://apify.com/phoenix2810/security-txt-auditor.md - **Developed by:** [Sanskar Jaiswal](https://apify.com/phoenix2810) (community) - **Categories:** Developer tools, Automation, Open source - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.005 / actor start This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Security.txt Auditor Security.txt Auditor checks whether a public website publishes vulnerability disclosure metadata using the security.txt convention. It tests the preferred `/.well-known/security.txt` path first, falls back to `/security.txt`, parses recognized fields, and returns a readiness score with specific recommendations. ### Use cases - Security teams checking disclosure readiness across owned domains. - Devops teams validating launch and migration checklists. - Compliance teams collecting evidence for vulnerability reporting processes. - Agencies auditing client websites for basic security contact hygiene. - Developer-tool builders adding security.txt checks to monitoring workflows. ### Input | Field | Type | Required | Description | | --- | --- | --- | --- | | `startUrl` | string | Yes | Public website URL to audit. HTTP and HTTPS are supported. Private IP ranges and URL credentials are blocked. | | `timeoutSeconds` | integer | No | Timeout for each HTTP request. Default: 10. Minimum: 3. Maximum: 30. | ### Output Each run pushes one dataset item. | Field | Type | Description | | --- | --- | --- | | `inputUrl` | string | The URL provided as input. | | `siteOrigin` | string | Normalized website origin checked by the actor. | | `found` | boolean | Whether a security.txt file was found and parsed. | | `fileUrl` | string | Security.txt URL that returned a parseable file. Empty when not found. | | `status` | integer or null | HTTP status of the selected response, or first attempted response when not found. | | `contentType` | string | Response content type for the selected file. | | `score` | integer | Readiness score from 0 to 100. | | `grade` | string | Letter grade: A, B, C, D, or F. | | `checkedAt` | string | ISO timestamp for the audit. | | `fields` | object | Parsed security.txt fields keyed by lowercase field name. Values are arrays because fields may repeat. | | `unknownFields` | array | Field names not recognized by this auditor. | | `findings` | array | Structured checks with name, status, points, and recommendation. | | `recommendations` | array | Plain-language fixes for missing or weak items. | | `attempts` | array | Fetch attempts for `/.well-known/security.txt` and `/security.txt`. | ### Example input ```json { "startUrl": "https://example.com", "timeoutSeconds": 10 } ```` ### Example output ```json { "inputUrl": "https://example.com", "siteOrigin": "https://example.com", "found": true, "fileUrl": "https://example.com/.well-known/security.txt", "status": 200, "contentType": "text/plain", "score": 95, "grade": "A", "checkedAt": "2026-07-08T00:00:00.000Z", "fields": { "contact": ["mailto:security@example.com"], "expires": ["2099-01-01T00:00:00Z"], "canonical": ["https://example.com/.well-known/security.txt"], "policy": ["https://example.com/security-policy"] }, "unknownFields": [], "findings": [ { "name": "File found", "status": "pass", "points": 20, "recommendation": null }, { "name": "Preferred path", "status": "pass", "points": 15, "recommendation": null } ], "recommendations": [], "attempts": [ { "url": "https://example.com/.well-known/security.txt", "status": 200, "ok": true, "error": null } ] } ``` ### Security The actor only fetches public HTTP and HTTPS URLs. It rejects URL credentials, private IPv4 literals, private IPv6 literals, and hostnames that resolve to private IP ranges. Redirects are followed manually and revalidated before each follow-up request. Response bodies are capped before parsing. ### Pricing Suggested pay-per-event pricing: | Event | Price | | --- | ---: | | Actor start | `$0.005` | | Website audited | `$0.01` | This keeps one-domain checks inexpensive while charging proportionally for successful dataset results. ### FAQ #### Does this actor verify that an email inbox works? No. It parses the published security.txt file and checks whether Contact values are present and use common forms such as `mailto:` or HTTPS URLs. It does not send emails or submit forms. #### Which paths are checked? The actor checks `/.well-known/security.txt` first, then `/security.txt` as a fallback. #### Does it require login or credentials? No. It only audits public unauthenticated website paths. #### What keep metric should be used? Keep or improve this actor if it receives organic Store impressions, runs, revenue, or inbound questions within 60 to 90 days. Archive it if there is no discovery and no usage. # Actor input Schema ## `startUrl` (type: `string`): Public website URL to audit. HTTP and HTTPS only. Private IP ranges and URL credentials are blocked. ## `timeoutSeconds` (type: `integer`): Timeout for each HTTP request. ## Actor input object example ```json { "startUrl": "https://example.com", "timeoutSeconds": 10 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrl": "https://example.com" }; // Run the Actor and wait for it to finish const run = await client.actor("phoenix2810/security-txt-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrl": "https://example.com" } # Run the Actor and wait for it to finish run = client.actor("phoenix2810/security-txt-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrl": "https://example.com" }' | apify call phoenix2810/security-txt-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=phoenix2810/security-txt-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Security.txt Auditor", "description": "Audit a public website's security.txt vulnerability disclosure metadata. Checks discovery paths, required fields, expiration, contact methods, and returns a readiness score with recommendations.", "version": "0.1", "x-build-id": "Ikb2cqHPCWlOGVOUI" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/phoenix2810~security-txt-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-phoenix2810-security-txt-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/phoenix2810~security-txt-auditor/runs": { "post": { "operationId": "runs-sync-phoenix2810-security-txt-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/phoenix2810~security-txt-auditor/run-sync": { "post": { "operationId": "run-sync-phoenix2810-security-txt-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "startUrl" ], "properties": { "startUrl": { "title": "Website URL", "pattern": "^https?://.+", "type": "string", "description": "Public website URL to audit. HTTP and HTTPS only. Private IP ranges and URL credentials are blocked." }, "timeoutSeconds": { "title": "Request timeout (seconds)", "minimum": 3, "maximum": 30, "type": "integer", "description": "Timeout for each HTTP request.", "default": 10 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```