Cloudflare.SecurityTxt reference

SecurityTxt

Source: src/Cloudflare/SecurityTxt/SecurityTxt.ts

A zone’s security.txt file (/zones/{zone_id}/security-center/securitytxt), served by the Cloudflare edge at https://<zone>/.well-known/security.txt per RFC 9116 so security researchers know how to report vulnerabilities.

The file is a singleton per zone with true create/delete semantics: creating the resource publishes the file, updating it is a full replace of every field, and destroying it removes the file from the zone entirely.

Cloudflare requires the RFC 9116 mandatory fields — contact and expires — on every write.

SecurityTxt: Publishing a security.txt

Minimal security.txt

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.SecurityTxt.SecurityTxt("SecurityTxt", {
  zoneId: zone.zoneId,
  contact: ["mailto:security@example.com"],
  expires: "2027-01-01T00:00:00Z",
});

Full security.txt with policy and acknowledgments

yield* Cloudflare.SecurityTxt.SecurityTxt("SecurityTxt", {
  zoneId: zone.zoneId,
  contact: ["mailto:security@example.com", "https://example.com/report"],
  expires: "2027-01-01T00:00:00Z",
  policy: ["https://example.com/security-policy"],
  acknowledgments: ["https://example.com/hall-of-fame"],
  encryption: ["https://example.com/pgp-key.txt"],
  preferredLanguages: "en, es",
});

SecurityTxt: Pausing without deleting

yield* Cloudflare.SecurityTxt.SecurityTxt("SecurityTxt", {
  zoneId: zone.zoneId,
  enabled: false,
  contact: ["mailto:security@example.com"],
  expires: "2027-01-01T00:00:00Z",
});