# security-txt

> security-txt is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Fetches and parses a domain's security.txt file (RFC 9116), extracting vulnerability disclosure contact, policy, expiry, encryption, and other fields, and flags expired files.

## Facts

- Endpoint: GET https://intel.rallylive.ca/site/security-txt
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/security-txt-8903bf8d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H4DphzQbziqZMIY9D4YjD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability security-txt-8903bf8d
```

Example prompt: Can you look up the security.txt for github.com and tell me the right contact to report a vulnerability, whether their policy link is listed, and if the file is still valid or expired?

## When to prefer this

Use this endpoint when you need to find the correct channel for reporting security vulnerabilities to a specific domain, verify a site's compliance with RFC 9116, or automate responsible disclosure workflows. Prefer this over manual HTTP fetching when you need structured parsing of all security.txt fields including expiry validation across both standard paths.

## Known failure modes

- Domain has no security.txt file at either standard path — returns not found
- security.txt file is malformed or missing required fields — partial parse returned
- Domain is unreachable or returns non-200 status — network error reported
- security.txt file exists but is expired — file returned with expiry flag set to true
- Domain input is invalid or malformed — input validation error

## How this service works

security.txt reader (RFC 9116): fetches /.well-known/security.txt (and the legacy /security.txt), parses Contact, Policy, Expires, Encryption, Acknowledgments, Preferred-Languages and Canonical, and flags an expired file. Find the right way to report a vulnerability. $0.01 per domain.

## Output

Returns parsed fields from the domain's security.txt file including Contact (email/URL), Policy URL, Expires timestamp, Encryption key URL, Acknowledgments URL, Preferred-Languages list, and Canonical URL. Also flags whether the file is expired. Returns data from /.well-known/security.txt with fallback to /security.txt.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/security-txt-8903bf8d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)