Methodology / security_txt

security.txt

What is checked: a file at https://<your site>/.well-known/security.txt with a Contact line and an Expires date in the future (RFC 9116).

Why it matters: when someone finds a security problem on your site, it tells them whom to tell. Without it, reports get lost or go public first.

Smallest fix: publish a plain-text file (Content-Type: text/plain) like this, and put a reminder in the calendar to renew Expires before it passes (at most a year ahead):

Contact: mailto:informatik@example-gemeinde.ch
Expires: 2027-10-31T23:00:00.000Z
Preferred-Languages: de, fr, en

The contact can be your own IT, your provider, or your canton's security team, as long as someone reads it. Common mistakes: the URL returns the homepage instead of the file; the date has passed; the file is only on http://.