3 ms·
Look for a www.domain-of-the-company.com/security.txt file. That's where you might find a responsible disclosure contact if the company has one (high chance the
by waihtis 4y ago
Look for a www.domain-of-the-company.com/security.txt file. That's where you might find a responsible disclosure contact if the company has one (high chance they don't)
- zamnos 4y agohttps://www.netflix.com/security.txt https://www.netflix.com/security.txt exits, but Apple, Google, Microsoft, and Meta don't have one.
- waihtis 4y agoThat would be because I typed the url wrong, it's actually /.well-known/security.txt: https://www.facebook.com/.well-known/security.txt https://www.facebook.com/.well-known/security.txt https://www.apple.com/.well-known/security.txt https://www.apple.com/.well-known/security.txt https://www.amazon.com/.well-known/security.txt https://www.amazon.com/.well-known/security.txt https://www.google.com/.well-known/security.txt https://www.google.com/.well-known/security.txt
- zamnos 4y agoTIL! That's great! The RFC for it came out April 22 and has backing by quite a few organizations. https://securitytxt.org/ https://securitytxt.org/
- tjpnz 4y agoDoesn't seem like a widely used convention.
- waihtis 4y agoThat would be because I typed the url wrong, it's actually /.well-known/security.txt: https://www.facebook.com/.well-known/security.txt https://www.facebook.com/.well-known/security.txt https://www.apple.com/.well-known/security.txt https://www.apple.com/.well-known/security.txt https://www.amazon.com/.well-known/security.txt https://www.amazon.com/.well-known/security.txt https://www.google.com/.well-known/security.txt https://www.google.com/.well-known/security.txt