How do #Finnish organizations instruct #security #vulnerability #disclosure using #securitytxt? Many organizations, such as CISA, and the French government, endorse the use of security.txt.

❌ = Not available
❕ = Available but flaws
✅ = Available and conforms #RFC9116

dvv.fi: ❌
eduskunta.fi: ❌
elisa.fi: ❕Missing date (RFC violation)
hel.fi: ❌
op.fi: ❌
puolustusvoimat.fi: ❌
kanta.fi: ❕Date against recommendation
suomi.fi: ❌
traficom.fi: ✅
yle.fi: ❕Date against recommendation

#Suomi #tietoturva

When a company doesn't adhere to RFCs 2142 or 9116, but you still tryna reach out.

A tale in two acts.

#BugBounty #BountyBegging #RFC2142 #RFC9116

Friends of #InfoSec I would like for some help! I would like to see your security.txt’s!

I am working with a lot of really small companies that will benefit from a good security.txt and if any group of people has good ones I know its gonna be here!

I already use and share https://securitytxt.org/ as well as the RFC https://www.rfc-editor.org/rfc/rfc9116

If you are a PenTester/Researcher, you should get a say too! What do you want in a security.txt file? What other updates should small orgs be adding to help you help us?

#securitytxt #RFC9116

As a maintainer of open-source software, I want to provide ways to disclose vulnerabilities. I already have a SECURITY.md in all my repositories on GitHub. There is a copy of it on my website (https://cj.rs/open-source/docs/security/), because why website hosts homepages for my projects.

Today, I’ve added a security.txt file (https://securitytxt.org/) in the standard location: https://cj.rs/.well-known/security.txt

#RFC9116 #securitytxt