The security contact file (security.txt)

In short

• Tillyard publishes a short text file at https://tillyard.org/.well-known/security.txt. It tells security researchers, and the tools they use, where to send a report.
• The file gives one contact, security@tillyard.org, and links to the Security and Vulnerability Disclosure Policy, which has the rules for testing.
• The file is built by the site each time it is asked for, so its expiry date always stays about six months ahead.
• The file is a signpost. It gives no permission by itself. The policy does that, and the policy governs.
• If the security address has not been set, the site answers "not found" and serves no file at all, so a stale or empty contact is never published.

If this summary and the full text below ever differ, the full text governs.

1 What this file is for

A security contact file is a convention, set out in an internet standard called RFC 9116, that lets a website say in a fixed place and a fixed format where security problems should be reported. People who find a weakness look there first. So do some automated tools.

The file answers one question: who do I tell? Everything else, including what testing is allowed and what we commit to in return, is in the Security and Vulnerability Disclosure Policy. Where this page and that policy cover the same point, the policy governs.

2 The exact contents

This is the file, line for line. Square brackets mark values that are filled in from the site's settings.

# [BRAND]: security contact
# If you have found a security problem on this site, thank you.
# Please read the policy linked below before you test anything.
# It says what is allowed and what is not. There is no bounty.
Contact: mailto:[SECURITY EMAIL]
Expires: [SECURITY TXT EXPIRES]
Preferred-Languages: en
Canonical: https://[DOMAIN]/.well-known/security.txt
Policy: https://[DOMAIN]/security

The file ends with a single line break after the last line. It contains nothing else: no names of people, no telephone number and no postal address.

2.1 An example as served

On 10 October 2026, with a 180-day window, the dated line would read:

Expires: 2027-04-08T00:00:00Z

3 What each line means

4 Lines the standard offers that we do not use

• Encryption. We do not publish an encryption key at present. The policy (section 7.4) says how to arrange a safer way to send sensitive details.
• Acknowledgments. People who asked to be thanked are listed in section 15 of the policy, which the Policy line already leads to. A separate line can be added if that list is ever given a page of its own.
• Hiring. Not used. The file is not a place for vacancies, and the company lists none there.

The file is not digitally signed. The standard recommends a signature and does not require one. Without one, a reader's assurance that the file is ours is that it was fetched over HTTPS from the address in the Canonical line.

5 How the file is served

• Address. https://tillyard.org/.well-known/security.txt. A request for https://tillyard.org/security.txt is redirected there.
• Format. A text file, encoded as UTF-8, over HTTPS only.
• Built on request. The site writes the file each time it is asked for. No copy is kept as a static file, because a stored copy's expiry date would go stale.
• Caching. A browser or a network may keep a copy for up to a day.
• If the contact is missing. If no security address is set in the site's settings, the address answers "not found". The site's own launch checks treat that as something to put right before opening.
• No cookies, no tracking. Fetching the file sets nothing in your browser and needs no sign-in.

6 Keeping it current

• The expiry date moves forward by itself. Nobody has to remember to edit it.
• The contact address is a mailbox that a person reads. If the address ever changes, it changes in one setting, and the file, the policy and the contact pages all follow.
• An automated test checks that the two required lines are present, that the expiry date is in the future and less than a year ahead, and that the file is withheld when the contact is blank.

7 If the site is not answering

The file is written by the site's software. If the site has paused because a daily allowance has run out, or is otherwise not answering, the file may not answer either. The security address still works, because it is an ordinary mailbox that does not depend on the site, and it is also printed on the static page of legal contacts that stays up when the site is paused.

8 Changes to this document

The version number and effective date are at the top, and earlier versions stay available. A change to the wording of the file is made here first.

9 Contact

• A security problem: security@tillyard.org
• Anything else: support@tillyard.org
• Post: Tillyard, 10602 York Rd SW, Etna, Ohio 43062

Questions about this document

support@tillyard.org

Legal notices

legal@tillyard.org

By post

10602 York Rd SW, Etna, Ohio 43062

For anything else, see where to send what.

Fingerprint of this text (SHA-256): 741ad709c8b8faec47b2dd56a73327250e05168201319f2687c35fd806750d6e