Publish a security.txt file on Shopify
Why it matters
A security.txt file tells researchers who to contact when they find a security problem on your site, so a report reaches you instead of being posted publicly or lost. It is a small plain text file defined in RFC 9116.
The fix
Not possible on Shopify. Shopify does not let a store serve its own file at /.well-known/security.txt. RFC 9116 allows a redirect, so try a URL redirect (Content, Menus, View URL redirects) from /.well-known/security.txt to a security.txt file uploaded under Content, Files, then open the address to check that it works. If it still returns 404, publish a security contact on a page of your store (for example your contact page) and accept the finding.
Related
- Reported by the security.txt check
- Serve security.txt from /.well-known/
- Serve security.txt over https
- Serve security.txt as text/plain with utf-8
- Add a Contact line to security.txt
- Fix the Contact value in security.txt
- Add an Expires line to security.txt
- Use an RFC 3339 date in the Expires line
- Renew the expired security.txt
- Renew security.txt before it expires
- Shorten the security.txt Expires date
- Fix repeated or insecure fields in security.txt
- Make the Canonical line match where the file is served
Scan your domain to see whether this applies to you.