Does security.txt need a real inbox?

It needs a contact route somebody monitors. A URI pointing at a page with a contact form is valid, and better than an address nobody reads.

Is an expiry date required?

Yes, RFC 9116 requires an Expires field. Set it a year out and put a reminder in the calendar.

Trust signals a machine can actually fetch, SecondDoor

The files that answer questions

An agent evaluating whether to transact with you asks the questions a procurement team asks: who do I contact about a vulnerability, what am I agreeing to, and is the service up. Each has a conventional answer at a conventional address.

A security.txt at /.well-known/security.txt with a Contact line is the smallest of these and the most frequently missing. It takes ten minutes.

Fetchable means readable as text

Terms rendered only after JavaScript, or served as a PDF behind a viewer, are not fetchable in any useful sense. The content exists and cannot be read by the thing asking.

A status page that returns JSON at a documented URL is worth more to a machine than a dashboard that animates beautifully.

The files that answer questions

Fetchable means readable as text

Questions