3 ms·
I've just checked the UK's GDS advice and they have it as a "should": https://gds-way.cloudapps.digital/manuals/security-overview-for-websites.html#10-implement
by milliams 3y ago
I've just checked the UK's GDS advice and they have it as a "should": https://gds-way.cloudapps.digital/manuals/security-overview-for-websites.html#10-implement-security-txt https://gds-way.cloudapps.digital/manuals/security-overview-...
They have more information at https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html https://gds-way.cloudapps.digital/standards/vulnerability-di... where they strengthen the advice by saving:
As per the current policy, we only accept reports from services that have a security.txt file pointing to the security policy.
- PrimeMcFly 3y ago> As per the current policy, we only accept reports from services that have a security.txt file pointing to the security policy. So if their security.txt doesn't point to a service someone finds an issue with they won't respond?
- iLoveOncall 3y agoOr they will respond by slamming down your door at 6AM :D I take it as a way to say "don't even think of touching the services that don't have the security.txt file".
- londons_explore 3y agoI think it means "our team isn't responsible for services without a security.txt, so don't contact us about it"
- InCityDreams 3y ago>I've just checked the UK's GDS advice and they have it as a "should": Without forgetting that a UK 'should', is considerably different to a US 'should'. .nl? - I'll let you guys decide.