SecurityTxtAndBugBountyKit: security.txt, CAA and disclosure policy in minutes
SecurityTxtAndBugBountyKit is a free, read-only check with 8 automated tests: Enter your domain. We check /.well-known/security.txt against RFC 9116 (Contact, Expires, Canonical, Policy, Encryption, signature), your CAA DNS records and your certificate issuer, then generate a valid security.txt, CAA records and a vulnerability disclosure policy for SOC 2 and ISO 27001 readiness. Results are instant; copy-paste fixes and monitoring start at $4.99. It is also available to AI agents as the MCP tool check_security_txt.
Enter your domain. We check /.well-known/security.txt against RFC 9116 (Contact, Expires, Canonical, Policy, Encryption, signature), your CAA DNS records and your certificate issuer, then generate a valid security.txt, CAA records and a vulnerability disclosure policy for SOC 2 and ISO 27001 readiness.
Unlock the complete deliverable
Your free check above is complete. The fix pack adds a copy-paste fix for every item that needs attention. The first 3 are below, free.
Tailor unlock for:
Card, Apple Pay, Google Pay or Link via Stripe; refunds on request within 14 days.
✓ Read-only, live public data · Key and unlock right after payment · Card, Apple Pay, Google Pay or Link via Stripe · Refunds on request within 14 days
Preview what the unlock includes
- A copy-paste fix for every check that needs attention, written for your page
- Where each fix goes (page HTML, server headers or DNS) and how to confirm it
- Re-run the free check any time to verify
Already paid? Enter your key or email to unlock
Read-only: two small HTTPS requests, one TLS handshake and public DNS lookups. The generated policy is a starting template, not legal advice; adapt safe-harbor language with counsel. A security.txt does not certify security.
Plans
Copy-Paste Fix Pack
$4.99 one-time
- One-time $4.99: copy-paste fixes for every failing check on one domain
- Unlocked instantly with your key
Weekly Monitor (5 domains)
$9 / month ($0.30/day)
- Weekly read-only re-check of up to 5 domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log on your watch dashboard and API, plus email alerts on changes
Agency 50-Domain Pro
$49 / month ($1.61/day)
- Daily checks for up to 50 client domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log, CSV export and API access
More ways to buy
500 API / MCP Credits
$9.99 one-time
- 500 full (unredacted) REST or MCP calls across every product
- Credits never expire
Unlimited API / MCP Key
$29 / month
- Unlimited full REST and MCP calls across every product. Billed monthly (or yearly at the annual price); cancel any time
- For Make, Zapier, n8n and AI agents
Watch My Domain
$5 / month
- Weekly read-only re-check of one domain. Billed monthly (or yearly at the annual price); cancel any time
- Email when the result changes
White-Label Client Report
$9.99 one-time
- One downloadable client-ready HTML report with your agency name and domain in the header
- No branding from us
Agency White-Label Pass
$79 / month
- Unlimited white-label client reports for this tool. Billed monthly (or yearly at the annual price); cancel any time
API: 10 free calls per day without a key. Datasets contain public records only, at organization level.
Payments are processed securely by Stripe. Refunds are available by default within the first 14 days of paid service.
Copy-paste fix pack
Often used together
- B2BTrustCenterAudit
- SslExpiryPulse
- TCEQ Industrial Air & Water Registration + Commercial Fleet & Heavy Equipment Trigger Multi-Signal Trigger
- FDA Medical Device Establishment Registration + Commercial Facility Permit Expansion Multi-Signal Trigger
- Pharmaceutical & Biologics NDC Facility Contract Re-Bid Window Tracker
- FdicDigitalSignAudit