{"uid":"cap_DbTbslNRWZn_4XaiR8aCD","slug":"sitecheck-security-txt-reader-c17b3ab8","name":"SiteCheck Security.txt Reader","description":"Fetches a site's security.txt from /.well-known/security.txt (fallback /security.txt) and parses the RFC 9116 fields: contacts, expiry (and whether it has expired), encryption, policy, acknowledgments, languages, canonical, hiring. Reports whether it is PGP-signed and lists RFC problems found. Public http(s) hosts only.","url":"https://api.sitecheck-api.workers.dev/api/web/security-txt?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Public http(s) URL of the site (any page; only the host is used)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"host":"www.cloudflare.com","hiring":["https://www.cloudflare.com/careers/jobs/"],"policy":["https://www.cloudflare.com/disclosure/"],"source":"The file published by the site, parsed against RFC 9116 (rfc-editor.org/rfc/rfc9116)","expired":null,"expires":null,"contacts":["https://hackerone.com/cloudflare","https://www.cloudflare.com/abuse/"],"location":"https://www.cloudflare.com/.well-known/security.txt","problems":["Expires is missing (required)"],"canonical":["https://www.cloudflare.com/.well-known/security.txt"],"checkedAt":"2026-10-15T17:43:54.305Z","compliant":false,"pgpSigned":false,"encryption":[],"acknowledgments":[],"preferredLanguages":["en"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_WLqWkOsta1sEZmqVIuViI","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches and parses a website's security.txt file (RFC 9116) to extract contact, policy, encryption, and compliance information","exampleAgentPrompt":"Can you fetch and parse the security.txt file for stripe.com and tell me who to contact to report a vulnerability, whether it's RFC 9116 compliant, and if it's PGP signed?","exampleUseCases":[{"title":"Vulnerability disclosure contact lookup","prompt":"I need to report a security bug to shopify.com — can you find their security.txt and tell me the right contact or bug bounty link to use?"},{"title":"Security compliance audit for vendors","prompt":"We're vetting a list of vendors and I need to check whether github.com has a valid, RFC 9116-compliant security.txt with a non-expired Expires field and a proper contact listed."},{"title":"Bug bounty program discovery","prompt":"Does google.com have a security.txt file? If so, pull it and tell me their preferred languages, any HackerOne or bug bounty links, and whether it's missing any required fields."}],"resultDescription":"A JSON object containing the parsed security.txt details for the target domain, including: security contact URLs or emails, vulnerability disclosure policy links, canonical file URL, expiry date and whether it has expired, PGP signing status, encryption key links, preferred languages, acknowledgment links, hiring links, a list of compliance problems (missing required fields), and whether the file is fully RFC 9116 compliant.","failureModes":["No security.txt file found at the domain (file absent or unreachable)","Domain is unreachable or returns non-200 status","Malformed security.txt that cannot be parsed against RFC 9116","URL parameter missing or not a valid http/https URL","Timeout fetching the remote security.txt file"],"whenToPreferThis":"Use this endpoint when you need to programmatically discover a website's responsible disclosure policy, security contact, or bug bounty information without manually navigating to /.well-known/security.txt. It is ideal for security audits, vendor assessments, or automated compliance checks that require RFC 9116 validation and structured output rather than raw file content.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:37:12.864Z","isFirstParty":false,"canonicalSlug":"sitecheck-security-txt-reader-c17b3ab8"}