Security
Disclosure
Publish a security.txt and a disclosure policy so people can report problems to you, and triage what they send.
Security → Disclosure helps you make it easy for people to tell you about a security problem, and keep track of what they report. It has three parts: a security.txt for your site, a disclosure policy to publish, and Reported problems, where you paste what people send.
security.txt
security.txt is a small text file at /.well-known/security.txt that tells people how to reach you about a security problem. Fill in:
| Field | What to enter |
|---|---|
| Contact | An email address (it becomes mailto:) or the https:// address of a form |
| Policy address | Where you’ll publish the disclosure policy below. Defaults to /security-policy on your site |
| Valid for | 1 to 12 months. The file must carry an expiry date; make a new one before it passes |
| Languages | The languages you can read reports in, e.g. en |
Make security.txt writes the file, checked with the same rules the security.txt check uses. Copy it and publish it at /.well-known/security.txt. The next scan confirms it’s there.
Disclosure policy
Make the policy writes a Markdown page that tells people how to report a problem, which sites are in scope (your product’s sites), what not to do (access other people’s data, slow the service down, phish your team), and that you won’t take legal action against people who follow it. It says there’s no paid bug bounty.
Warning
The policy is a starting point, not legal advice. Edit it to match how you actually handle reports, and have whoever handles legal questions read it before you publish it.
Reported problems
When someone emails you about a security problem, paste it here with Add a report. With an AI key, it’s triaged (about $0.02):
- Severity, and whether it looks real, is unclear (no concrete evidence yet) or is probably not a problem (generic or automated reports, like ones asking for a bounty before sharing details).
- A finding you already have, when it’s the same problem the checks found.
- What’s missing, to ask the reporter for.
- A reply to send: short and polite, asking for what’s missing. It never promises money, a fix date or legal terms. Copy it into your email; Startica never sends anything.
Then:
- Track as a finding adds it to Findings (or links it to the finding it duplicates), so it’s in the report and can go to the Roadmap or an issue tracker. You need a verified site for this.
- Resolved or Dismiss moves it out of the list; Reopen brings it back.
What people send is treated as untrusted text: the AI is told to ignore any instructions in it, and nothing in it is followed or opened.