LLL Security.txt Builder / 脆弱性報告窓口ファイル

Does installing the plugin publish my file? Put the text on your HTTPS site at /.well-known/security.txt after generating it. The plugin runs in the admin and cannot take over the site's public path.

What does it check? It checks supported contact URLs, selected optional fields, and expiration dates on unsigned UTF-8 text up to 8 KB. It warns within 30 days of expiration and caps future expiration at 366 days. The checker accepts a subset of RFC 9116, including HTTPS, mail and phone contacts, and HTTPS policy and encryption URLs. Check public reachability and contact ownership on your site separately.

Can I check a signed file? Use a dedicated signature verification tool for OpenPGP-signed files.

Will I get a reminder? The remaining days appear when you submit the file. Keep a renewal reminder in your own calendar if needed.

Administrators with plugins:manage can use the tool. The signed manifest declares no plugin capabilities or network hosts. Inputs are processed in the site's plugin sandbox and the plugin stores nothing, fetches no URLs, and sends no telemetry. Text copied into the website is public. Enter an organizational disclosure address intended for publication.

Report a vulnerability to contact@lx3.cafe. File format and deployment requirements are documented in RFC 9116.

0.1.0

• Create unsigned disclosure text and check existing files from the EmDash admin.
• Show expiration status and flag malformed contact or expiration data.

1. Install LLL Security.txt Builder from your site's EmDash Registry and open Security.txt Builder as an administrator.
2. Enter your organization's public disclosure contacts in order of preference and a future expiration with a time zone. Add a public policy, canonical link, or preferred languages if you need them. Select Generate security.txt. To check an existing unsigned file, paste its text into Check pasted file.
3. Copy the generated text into a plain UTF-8 file named security.txt. In a standard Astro project place it at public/.well-known/security.txt before deploying. Follow your platform's static-file convention for other projects. Open the deployed https://your-domain/.well-known/security.txt to check the text and content type. Renew the file before it expires.

管理画面の Security.txt Builder で公開用の窓口と有効期限を入力します。生成した本文はサイトの /.well-known/security.txt に設置し、HTTPS で表示されることを確認してください。既存の署名なしファイルは本文を貼り付けて点検できます。