Security.txt & Well-Known Policy Auditor

Check public websites for RFC 9116 security.txt discovery, HTTPS placement, contact details, expiry signals and structured security-policy hygiene findings.

Why use this Actor

Security and asset teams need recurring evidence that vulnerability-disclosure and security-related /.well-known endpoints remain discoverable, current and consistent across website portfolios.

Key features

• Buyer-native inputs aligned to well-known policy.
• Predictable structured output in the default Apify Dataset.
• Pay Per Event pricing tied to measurable result rows or reports.
• Optional MCP connector delivery for downstream automation and AI agents.

Quick start

Start with this working example and replace the target values with your own:

{
  "urls": [
    "https://www.google.com",
    "https://github.com"
  ]
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• urls — Websites: Public sites to audit for RFC 9116 security.txt policy.
• previousSnapshots — Previous policy snapshots: Optional prior snapshots keyed by input or final URL for drift detection.
• failRunOnRisk — Fail run on material policy risk: Fail after writing evidence when a policy is missing, expired, or regresses.
• maxUrls — Maximum websites: Configure Maximum websites for this Actor run.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include dataset.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.001000 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Detailed documentation

Detailed documentation

Audit public websites for RFC 9116 vulnerability-disclosure policy health, expiry, discoverability, and change evidence.

Why use this Actor

A security.txt file is small, but it is operationally important. Security teams, agencies, asset owners, and vendor-risk programs need to know whether a public vulnerability-disclosure contact exists, whether the policy is still current, whether it is published at the preferred well-known path, and whether a deployment or domain migration silently changed it. This Actor turns those checks into deterministic structured evidence that can be scheduled, compared, exported, and consumed by CI or agent workflows.

Key features

• Checks /.well-known/security.txt first and supports the legacy /security.txt location.
• Parses Contact, Expires, Canonical, Policy, Encryption, Preferred-Languages and related RFC-style fields.
• Validates expiry and calculates days remaining until expiration.
• Distinguishes missing, legacy-only, expired, incomplete, and healthy policy states.
• Emits a reusable normalized policy snapshot and SHA-based fingerprint.
• Compares an optional previous snapshot and reports exact changed fields and regression state.
• Supports a fail-after-evidence gate for CI/CD or scheduled policy monitoring.
• Rejects private, loopback, link-local, reserved, and otherwise unsafe destinations.

Input

Provide a urls array containing public HTTP or HTTPS websites. Optional previousSnapshots may be keyed by the original or final URL. Set failRunOnRisk when a workflow should fail after evidence is stored if a material policy problem is detected. maxUrls bounds batch size.

Output

Each result includes the final URL, status, score, discovered location, contacts, expiration date, days to expiry, Canonical/Policy/Encryption metadata, fingerprint, changed fields, regression flag, issue codes, and an agentAction suitable for automation.

Example

{
  "urls": ["https://github.com"],
  "previousSnapshots": {},
  "failRunOnRisk": false,
  "maxUrls": 100
}

A healthy result can return score: 100, location: "well-known", parsed contact methods, an expiry horizon, and agentAction: "MONITOR".

Use cases

• Vulnerability disclosure program QA.
• Domain and attack-surface inventories.
• Vendor-risk and supplier evidence collection.
• Scheduled expiry monitoring.
• Website migration and release regression checks.
• Agency portfolio audits.

Pricing

Billing is pay per successfully audited result. There is no separate external security API or AI service required by the Actor.

Limitations

This Actor audits observable public security.txt metadata. It does not test whether a security team responds to reports, does not verify organizational ownership, and does not perform penetration testing or vulnerability discovery. Network failures and upstream blocking are returned as explicit evidence rather than hidden.

Privacy and permissions

Only public HTTP(S) targets are accepted. Private and reserved network destinations are rejected before requests are made. The Actor reads public policy text and does not request credentials or private security reports.

Input reliability — 25 October 2026

Target lists are validated before network work, trimmed and deduplicated. Empty lists and malformed baselines are rejected rather than silently auditing a default website. Exact duplicate targets produce one result. Existing output fields and prices are preserved.

• 2026-10-25: parse lowercase UTC z expiry timestamps; flag invalid expiry dates instead of awarding a clean score.