RFC9116

[mdavids]

The website says: "Just as security.txt can be deployed into either the root or the .well-known directory of a webserver,...", but with RFC9116 this is no longer true. RFC9116 says: "For web-based services, organizations MUST place the "security.txt" file under the "/.well-known/" path"

UPDATE: In "3 Location of the security.txt File" it says different, so I was wrong. Please close ticket.

[oh2fih]

The /.well-known/security.txt is the correct path, and /security.txt is allowed only for backwards compatibility.

A complete quote from RFC 9116 section 3:

For web-based services, organizations MUST place the "security.txt" file under the "/.well-known/"
path, e.g., https://example.com/.well-known/security.txt as per [RFC8615] of a domain name or IP
address. For legacy compatibility, a "security.txt" file might be placed at the top-level path or
redirect (as per Section 6.4 of [RFC7231] ) to the "security.txt" file under the "/.well-known/" path. If
a "security.txt" file is present in both locations, the one in the "/.well-known/" path MUST be used.

While the website could argue both are allowed, they should still be in reverse order:

Just as security.txt can be deployed into either the the .well-known directory or root of a webserver,...

[yosignals]

Looks like a job for @caseyjohnellis :)

[yesnet0]

Closing per the issue update/request. The RFC9116 location nuance is captured in the discussion above; thanks for raising it.

[oh2fih]

@yesnet0 One small point remains for technical accuracy. While RFC 9116 permits both locations for legacy compatibility, /.well-known/security.txt is the normative location and /security.txt is the legacy fallback.

The current wording still says:

"Just as security.txt can be deployed into either the root or the .well-known directory of a webserver..."

This subtly suggests that the two locations are equivalent. To better reflect RFC 9116, I would suggest reversing the order:

"Just as security.txt can be deployed into either the .well-known directory or, for legacy compatibility, the root of a webserver..."

or similar wording that presents /.well-known/security.txt as the primary location and the root path as the compatibility option.

[yesnet0]

Good catch @oh2fih — agreed, the old wording read as if the two locations were equivalent. I've adopted your suggested wording near-verbatim in #17, which is now live on the site:

Just as security.txt can be deployed into either the .well-known directory of a webserver or, for legacy compatibility, the webserver root (RFC 9116 defines /.well-known/security.txt as the normative location)...

Thanks for keeping this accurate.