In April 2022, the RFC related to the small file “security.txt” was released[1]. It was already popular for a while, but an RFC is always a good way to “promote” some best practices! If you're unaware of this file, it helps to communicate security contacts (email addresses, phone, ...) to people who would like to contact you to report an issue with your website or your organization.  This security.txt file was deployed on my websites for a while, and I never really paid attention to its popularity. The ISC also has its one[2].

A few weeks ago, I received a mail from a bug bounty player (or a script kiddie?) who found a critical XSS vulnerability... on one of my honeypots :-). Based on the information provided in my security.txt, he contacted me through this file. So, they became popular? Who visits these files?

I did a quick query on my logs and found some interesting information. The fastest way is to extract all requests to “*/security.txt” in the URI and include the HTTP Referer.

My first hits were in March 2019. As of today, there were 12.649 hits to these files. First, we see a clear trend over the years:

Almost all of them were direct access (without Referer): 12.659

The ones that came from other websites were originating from bug bounty platforms (that could explain the message mentioned above). The most active platform is firebounty.com. The question is now: why do they list me because I never started a bug bounty program? One of my domains is indeed listed:

As you can see, data has been fetched by Onyphe[3], a popular service similar to SHODAN.

Most of the requests were performed without a referer. Let’s have a look at the User-Agents header. I found some crawlers and bots available in the wild:

• Nuclei
• Curl
• Python

The most popular was "Go-http-client/1.1". The other requests were based on classic browsers User-Agent (probably most of them fake).

What about spam? Because when you create such a file, you provide contact details. Honestly, I did not get a huge increase in spam, but for sure, some bots are actively looking at this file.

[1] https://www.rfc-editor.org/rfc/rfc9116
[2] https://isc.sans.edu/.well-known/security.txt
[3] https://www.onyphe.io

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key