SecurityTxtAndBugBountyKit / report
SecurityTxtAndBugBountyKit report: demo-saas.example
Demo report on a fictional sample site.
0 / 100
8 of 8 checks need attention (3 high priority).
- ✗ security.txt at /.well-known/ (high): Not found.
- ✗ Contact field (required) (high): Missing.
- ✗ Expires field set, in the future and under a year out (required) (high): Missing.
- ✗ Canonical URL (low): Missing.
- ✗ Disclosure policy link (medium): Missing.
- ✗ Preferred-Languages (low): Missing.
- ✗ OpenPGP signature (optional) (low): Not signed.
- ✗ CAA records restrict who can issue certificates (medium): None. Current certificate issuer: Let's Encrypt.
Read-only: two small HTTPS requests, one TLS handshake and public DNS lookups. The generated policy is a starting template, not legal advice; adapt safe-harbor language with counsel. A security.txt does not certify security.
Often used together
- B2BTrustCenterAudit
- SslExpiryPulse
- TCEQ Industrial Air & Water Registration + Commercial Fleet & Heavy Equipment Trigger Multi-Signal Trigger
- FDA Medical Device Establishment Registration + Commercial Facility Permit Expansion Multi-Signal Trigger
- Pharmaceutical & Biologics NDC Facility Contract Re-Bid Window Tracker
- FdicDigitalSignAudit