# securitytxtkit report: demo-saas.example

> Demo report on a fictional sample site.

**Score:** 0/100 · Scanned 2026-10-26T22:31:31.132Z

8 of 8 checks need attention (3 high priority).

- [ ] **security.txt at /.well-known/** (high): Not found.
- [ ] **Contact field (required)** (high): Missing.
- [ ] **Expires field set, in the future and under a year out (required)** (high): Missing.
- [ ] **Canonical URL** (low): Missing.
- [ ] **Disclosure policy link** (medium): Missing.
- [ ] **Preferred-Languages** (low): Missing.
- [ ] **OpenPGP signature (optional)** (low): Not signed.
- [ ] **CAA records restrict who can issue certificates** (medium): None. Current certificate issuer: Let's Encrypt.

---
Read-only: two small HTTPS requests, one TLS handshake and public DNS lookups. The generated policy is a starting template, not legal advice; adapt safe-harbor language with counsel. A security.txt does not certify security.