# Security disclosure

security.txt tells a researcher how to report a vulnerability. RFC 9116 requires an expiry date so stale contacts stop being trusted, which means a file nobody renews fails on a date you could have known.

## What goes wrong

- Expires passes and the file stops counting, usually discovered in an audit.
- The file is served from the wrong path, or as an HTML page.
- Expires is set years ahead, which RFC 9116 advises against.

## What Flowpane does

- Scores an expired file at zero. It is a hard rule, not a warning.
- Flags files that expire within 30 days, and expiry dates more than a year ahead.
- Checks required fields, date formats, and the canonical location.

## Go deeper

- https://flowpane.com/learn/security-txt.md
- https://flowpane.com/learn/scoring.md
- https://flowpane.com/learn/how-flowpane-fetches.md
- https://flowpane.com/for/enterprise.md
- https://flowpane.com/for/operators.md