# Add security.txt file to php.net

- Thread: https://externals.io/message/121163
- Original archive: https://news-web.php.net/php.internals/121163
- Started by Ben Ramsey on 2023-09-28T19:15:34+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #121163 — Ben Ramsey — 2023-09-28T19:15:34+00:00

URL: https://externals.io/message/121163#121163

I've just opened a PR on web-php to add a security.txt file to php.net[1].

Since there's currently some discussion around security audit 
priorities[2], I decided to notify this list first and see if there are 
any questions or concerns about adding a security.txt file.

This file implements the standard defined in RFC 9116[3] for a
machine-parsable format to aid in security vulnerability disclosure.

Of note:

1. We must include an Expires field, which the RFC suggests should be
    less than a year in the future. I have set it for the assumed date
    for GA of PHP 8.4/9.0. I recommend we update the expires time each
    year on this date, since it's already a date of significance for us.

2. I have signed it with my php.net release manager key. Since we
    publish our release manager keys, I'm recommending that a release
    manager for a currently supported version of PHP (at the time) be the
    one to digitally sign this file after making changes.

For more details about security.txt, see <https://securitytxt.org>.

Cheers,
Ben


[1]: https://github.com/php/web-php/pull/816
[2]: https://externals.io/message/121135
[3]: https://www.rfc-editor.org/rfc/rfc9116