Security.txt (2017)
I understand and welcomed the initiative when it was first discussed. Meanwhile I&#x27;ve implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI).<p>It was a massive waste of time for me to engage with a group of &quot;<i>unknowns</i>&quot; -without prior relationship- who now had a channel to fast-track into my inbox (and got my attention).<p>The volume of mails was anywhere from 5-20 emails per week which is a lot if you need to go through the points in every mail but you don&#x27;t have any idea if the entity behind the <i>poor-security-report</i> is even skilled. So you start in good-faith that the report they gave you (e.g. you tell yourself that your own time analysing it is justified &quot;they&#x27;re probably competent&quot;, &quot;they know what they&#x27;re doing otherwise they&#x27;d have a different job&quot;, &quot;maybe somebody will get lucky this time&quot;, or depending how many bad reports you already read you might be down to &quot;even a blind chicken finds a kernel of corn every now and then&quot;)<p>it seems I ended up having endless discussions with people who automated the whole thing: they crawl the web for &#x2F;.well-known&#x2F;security.txt URI and if the find it, automatically start-up metasploit or burp-suite and then send you the canned report while asking you to fix these &quot;serious problems&quot;. 
Yet if you quiz any of these &quot;researchers&quot; deeper about individual items in their canned reports you get nothing but blank stares, incompetence and attempts to weasel out: <i>&quot;but burpsuite says that it is an error and you should correct it&quot;</i>, ...<p>Initially I went through every email patiently. I tried to engage these guys on why they strongly felt it were vulns or 0days (LOL). I knew what they reported was canned and they never questioned the context or the errors themselves. None of them were people that I would hire or trust to give me good advise. Advise wasn&#x27;t always just bad. Often they have a whole consulting company sitting behind them who not only &quot;fix your problems&quot; but also migrate your whole stack to Drupal or Wordpress or some such nonsense.<p>If I look at the other end of the spectrum (infosec-memes and &quot;thought leaders&quot; on twitter) I get people complaining that some customers just don&#x27;t know how bad their security is and they even dare to ignore their reports or worse (question them on their authority in whether this is a bug or not). The whole thing is the deaf leading the blind here. I get what security.txt was trying to improve because there is&#x2F;was a real issue for people to find a point of contact. But I do not think security.txt is in any way useful. And it&#x27;s a total waste of time and money for small companies and bigger companies alike. (if you&#x27;re bigger you get more attention = more reports but that doesn&#x27;t improve quality - it only adds more work on your end because now you have N-people (instead of 1 or 2) discussing these constant &quot;non-problems&quot;.