# SiteCheck Security.txt Reader

> SiteCheck Security.txt Reader is a paid API for AI agents from api.sitecheck-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-20).

Fetches and parses a website's security.txt file (RFC 9116) to extract contact, policy, encryption, and compliance information

## Facts

- Endpoint: GET https://api.sitecheck-api.workers.dev/api/web/security-txt?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-security-txt-reader-c17b3ab8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_DbTbslNRWZn_4XaiR8aCD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-security-txt-reader-c17b3ab8
```

Example prompt: Can you fetch and parse the security.txt file for stripe.com and tell me who to contact to report a vulnerability, whether it's RFC 9116 compliant, and if it's PGP signed?

## When to prefer this

Use this endpoint when you need to programmatically discover a website's responsible disclosure policy, security contact, or bug bounty information without manually navigating to /.well-known/security.txt. It is ideal for security audits, vendor assessments, or automated compliance checks that require RFC 9116 validation and structured output rather than raw file content.

## Known failure modes

- No security.txt file found at the domain (file absent or unreachable)
- Domain is unreachable or returns non-200 status
- Malformed security.txt that cannot be parsed against RFC 9116
- URL parameter missing or not a valid http/https URL
- Timeout fetching the remote security.txt file

## How this service works

Fetches a site's security.txt from /.well-known/security.txt (fallback /security.txt) and parses the RFC 9116 fields: contacts, expiry (and whether it has expired), encryption, policy, acknowledgments, languages, canonical, hiring. Reports whether it is PGP-signed and lists RFC problems found. Public http(s) hosts only.

## Output

A JSON object containing the parsed security.txt details for the target domain, including: security contact URLs or emails, vulnerability disclosure policy links, canonical file URL, expiry date and whether it has expired, PGP signing status, encryption key links, preferred languages, acknowledgment links, hiring links, a list of compliance problems (missing required fields), and whether the file is fully RFC 9116 compliant.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Public http(s) URL of the site (any page; only the host is used)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "host": "www.cloudflare.com",
  "hiring": [
   "https://www.cloudflare.com/careers/jobs/"
  ],
  "policy": [
   "https://www.cloudflare.com/disclosure/"
  ],
  "source": "The file published by the site, parsed against RFC 9116 (rfc-editor.org/rfc/rfc9116)",
  "expired": null,
  "expires": null,
  "contacts": [
   "https://hackerone.com/cloudflare",
   "https://www.cloudflare.com/abuse/"
  ],
  "location": "https://www.cloudflare.com/.well-known/security.txt",
  "problems": [
   "Expires is missing (required)"
  ],
  "canonical": [
   "https://www.cloudflare.com/.well-known/security.txt"
  ],
  "checkedAt": "2026-10-15T17:43:54.305Z",
  "compliant": false,
  "pgpSigned": false,
  "encryption": [],
  "acknowledgments": [],
  "preferredLanguages": [
   "en"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-security-txt-reader-c17b3ab8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.sitecheck-api.workers.dev](https://www.zero.xyz/host/api.sitecheck-api.workers.dev/llms.txt)