Search code examples
securitywebrobots.txtsecurity.txt

What is the use of the h̶a̶c̶k̶e̶r̶s̶.̶t̶x̶t̶ security.txt file?

First

No I am not asking you to teach me hacking, I am just curious about this file and its content.

My journey

When I dived into the new HTML5 Boilerplate I came accross the humans.txt. I googled for it and I came at this site http://humanstxt.org/.

Immediately my attention went to this picture:

Where is it located

Do I read this correctly? Hackers.txt?

So I resumed my journey in google and stopped at this articles

When I started reading this I had the feeling that its about the difference between Hackers and Crackers. Later I got the feeling that I'm might be wrong and that this place is that this hackers.txt file is a sort of guestbook for hackers?

Also other examples about hackers.txt files I found here

Some files contain code, others have just hurtfull information.

Now I'm realy confused, guestbook, hack tutorials or just history?

Question

What is the use of this hackers.txt file?

Solution

  • TL;DR:

    To quote from RFC-9116 "A File Format to Aid in Security Vulnerability Disclosure" (published 2022-04-27):

    When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.

    This security.txt file was previously known as hackers.txt

    The Full Story

    Commonly known as Eduardo Vela, Eduardo A. Vela Nava (or sirdarckcat on Github and Twitter) has been a Security Engineer at Google since 2010. (He currently has the role of Product Security Response Team Lead).

    As other security experts before him, he pondered the issue of effectively communicating the details of a site's vulnerability reward program to white hat hackers/pen-testers.

    One specific such person is Chema Alonso (also on Twitter).

    He is well-known enough to warrant a Spanish Wikipedia entry

    Between 2005 and 2011 Alonso was awarded the Microsoft Most Valuable Professional Award for Enterprise Security 6 years in a row. That should tell you something about his "skillz".

    On February 3rd 2011 Alonso wrote about his frustrations regarding the topic of communication between the administrators and/or developers of a site and hackers.

    Screenshot of Alonso's hackers.txt blog-post

    He proposes a similar initiative as humans.txt but for hackers. As he mentions this hackers.txt initiative in his blog-post.

    In April 2011 The humanstxt.org website got a new design which includes the image which mentions the hackers.txt file.

    At this point, I must sadly submit to conjecture, but... consider:

    • The team behind humans.txt are all from Spain (mostly Barcelona)
    • At this point Alonso is already quite well known in the Spanish developer community

    Would it be such a far stretch to imagine that they got to know of each other's efforts?

    On May 14th 2014 Vela, already working at Google, commented on a blog-post by Alonso. It is most likely that they had further contact in a professional setting. Whether or not thay extively shared their idea's regarding anything related to hackers.txt is unknown.

    On July 6th 2017 Vela posted a question to this extent on twitter:

    Screenshot of the Twitter post by Eduardo Vela

    How about we create a /hackers.txt that says whether something is in scope or not of a vulnerability reward program and where to report it?

    Subsequently, an empty git repository was created for hackerstxt.org on github and an email thread was opened at Google Groups to discuss this idea further.

    On August 13 2017, Edwin Foudil (or EdOverflow on Github and Twitter) created a git repository for security.txt on Github and responded to the mailing list:

    I have published a similar project to the one being discussed in this group (https://github.com/EdOverflow/security-txt) and would love to get some of your feedback and ideas.

    The project is the equivalent of robots.txt, but for defining a security policy. Companies can add a security.txt to their website and define clear guidelines of what security researchers must do when they discover a security issue. security.txt also allows bug bounty programs to add their scope there. security.txt uses a similar syntax to robots.txt, which should make it easier for machines to parse.

    He was, in part, inspired by an open-source project he was working on at the time called GratiPay. GratiPay had a SECURITY.txt file since 2013.

    His inspiration also drew from the SECURITY.md files that more and more open-source projects were adding to their repositories.

    On September 10th 2017, Foudil submitted a first draft for security.txt to the Internet Engineering Task Force.

    enter image description here

    On September 14th 2017 Alonso wrote a blog post with the title (translated from Spanish) "Security.TXT an IETF draft for my Hackers.TXT".

    Beyond the title, Alonso does not allude to the fact that his 2011 idea was the origin of the draft but he does state his approval of the effort.

    On February 3rd 2018, the mail group was informed to concede to security.txt and Vela tweeted that Google had already implemented one.

    On April 27th 2022, after various drafts RFC-9116 was published. The security.txt is now an official standard! 🎉

    history of RFC-9116

    Further information

    Details and a nifty tool to generate your own security.txt can be found at https://securitytxt.org/

    Screenshot of the securitytxt.org website

    Adoptation

    Even though the RFC is still in draft, the standard is already being adopted quite well by major players on the web.

    Besides the security.txt at Google, there is also one on the website of:

    (Feel free to add more from well-known sites, if you find 'm)