2 ms·
Why would you receive any more or less garbage to contact information in a security.txt va just having a security@example.com email on your contact page? You’l
by koolba 2y ago
Why would you receive any more or less garbage to contact information in a security.txt va just having a security@example.com email on your contact page?
You’ll get the same amount of spam and irrelevant random bug bounty demanders. There’s no substitute to having someone look at the messages and find that needle in the haystack.
Though there are some signal to noise ratio tricks: https://xkcd.com/1181/ https://xkcd.com/1181/
- toomuchtodo 2y agoI expect a good faith reporter to know of and consume security.txt for reporting. Whether that assumption is valid remains to be seen of course, but I am confident in the assumption (vs an email address advertised on a webpage). I can also control security.txt through Cloudflare as an option, and have less control of website content. https://developers.cloudflare.com/security-center/infrastructure/security-file/ https://developers.cloudflare.com/security-center/infrastruc...