# Event website security.txt and report-routing worksheet

Use this as an **example**, not as a live contact file. Replace every `example.com` address and date, confirm the inbox is monitored, and have the scope and any disclosure policy approved by the responsible operator.

```text
Contact: mailto:security@example.com
Expires: 2027-03-01T00:00:00Z
Canonical: https://example.com/.well-known/security.txt
Preferred-Languages: en
```

Publish the adapted file at `https://YOUR-DOMAIN/.well-known/security.txt` over HTTPS as UTF-8 `text/plain`. `Contact` and `Expires` are required by RFC 9116. `Canonical` and `Preferred-Languages` are optional. Set the expiry for a date you will renew; the RFC recommends less than one year ahead. A `Policy` link belongs here only if an actual approved policy exists. The file applies to the domain serving it, not automatically to subdomains.

## Routing worksheet

**Event / website domain:** [ ]  **Website operator:** [ ]  **Ticket or registration provider:** [ ]
**Security contact URI:** [ ]  **Primary monitor:** [ ]  **Backup monitor:** [ ]
**Provider vulnerability handoff (official channel):** [ ]  **Incident response lead:** [ ]

| Report concerns | First receiver | Technical owner | Acknowledgement owner | Escalation / evidence location |
| --- | --- | --- | --- | --- |
| Event site code or hosting | [ ] | [ ] | [ ] | [ ] |
| Registration form / attendee data | [ ] | [ ] | [ ] | [ ] |
| External ticket checkout | [ ] | [provider] | [ ] | [ ] |
| Possible active compromise | [ ] | [ ] | [ ] | [separate incident plan] |

## Public verification and renewal

- [ ] Exact HTTPS URL opens without a staff session and responds with readable plain text.
- [ ] Contact is a valid URI and reaches the named owner and backup in a harmless internal test.
- [ ] Expires is future-dated and renewal is on the maintenance calendar.
- [ ] Canonical, if present, matches an actual URL serving this file.
- [ ] Each hostname in scope is checked separately; provider domains are not claimed as yours.
- [ ] The contact and handoff still work after team, domain or hosting changes.

**Last public check:** [ ]  **Test receipt:** [ ]  **Next renewal date / owner:** [ ]

A contact file is not permission to test a site, a legal safe harbor, a bounty offer, or proof that a vulnerability has been fixed. Do not publish such commitments without an approved policy.

Sources: [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116.html) and [UK NCSC Vulnerability Disclosure Toolkit](https://www.ncsc.gov.uk/information/vulnerability-disclosure-toolkit).