Flowpane / Docs
Documentation / Governance Checks / security.txt

RFC 9116 compliance

Contact (required)

At least one Contact: field containing a URI. Web contacts must use https://; mailto: and other valid URI schemes are preserved according to their syntax.

Expires (required)

Exactly one RFC 3339 date-time with a timezone, in the future. Flowpane warns if it is within 30 days and recommends review when it is more than one year ahead.

Optional fields

  • Encryption — PGP key link
  • Acknowledgments — hall of fame URL
  • Preferred-Languages — e.g. en, fr, de
  • Canonical — canonical URL of the file itself
  • Policy — vulnerability disclosure policy URL
  • Hiring — security job openings URL

Flowpane preserves all occurrences, unknown extension fields and clear-signature evidence. It detects clear-signed form but does not cryptographically verify OpenPGP signatures or establish signer trust.