Security.txt Checker — Security Contact Finder

Check any list of websites for security.txt and extract structured security contact data.

Use it for vendor security reviews, bug bounty intake audits, compliance monitoring, agency reports, and scheduled checks that alert you when a site's security contact file disappears or expires.

Example result:

{
    "domain": "securitytxt.org",
    "checkedUrl": "https://securitytxt.org/.well-known/security.txt",
    "status": "found",
    "hasSecurityTxt": true,
    "contacts": ["mailto:security@example.com"],
    "expiresAt": "2027-01-01T00:00:00.000Z",
    "isExpired": false,
    "policy": ["https://example.com/security-policy"],
    "scrapedAt": "2026-07-09T10:30:00.000Z"
}

How to use it

1. Paste one or more domains or URLs.
2. Keep the root fallback enabled if you also want to check /security.txt.
3. Start the Actor and export the Dataset as JSON, CSV or Excel.

Pricing

Pay per result, no subscription:

Event	Price
Run start	$0.005
Per checked domain	$0.0005

1,000 checked domains cost about $0.505 before Apify platform usage.

Output fields

Field	Type	Always present
domain	string	Yes
checkedUrl	URL	Yes
status	string: found, expired, missing	Yes
hasSecurityTxt	boolean	Yes
statusCode	number or null	No
contacts	array	Yes
expiresAt	ISO date or null	No
isExpired	boolean or null	No
encryption	array	Yes
acknowledgments	array	Yes
preferredLanguages	array	Yes
canonical	array	Yes
policy	array	Yes
hiring	array	Yes
csaf	array	Yes
unknownFields	array	Yes
attempts	array	Yes
scrapedAt	ISO date	Yes

Limitations

• It reads public security.txt files only.
• It does not validate cryptographic signatures.
• Missing files are returned as normal results because the absence is useful audit data.

FAQ

Why do missing files appear in the dataset? For compliance and monitoring workflows, "missing" is an actionable status.

Can I schedule it? Yes. Schedule it weekly or monthly to monitor a portfolio of domains.

Does it call private APIs? No. It only requests public website URLs.

Verified automation package

The following reproducible example comes from successful Apify run fAG15T4UybKDbNRpS. See the full Q Services technical guide and the tested n8n automation example.

Audit public domains for security.txt availability and expiry, then reuse the structured results in scheduled vendor-risk, compliance, or security-operations monitoring.

High-value use cases

• Weekly security.txt monitoring across a vendor portfolio
• Security contact discovery for incident-response preparation
• Expiry and missing-file alerts after website releases
• Evidence collection for recurring vendor-risk reviews
• Managed security reporting across customer domains

Target audience: Security operations, vendor-risk, compliance, and managed-service teams monitoring portfolios of public domains

Growth hypothesis: A portfolio-monitoring position and reusable n8n loop will increase repeat runs by teams that need continuous security-contact coverage rather than a one-time lookup.

Tested input

{
  "startUrls": [
    "https://securitytxt.org"
  ],
  "includeRootFallback": true,
  "maxResults": 1,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}

Clean output sample

[
  {
    "domain": "\u003cstring\u003e",
    "checkedUrl": "\u003cstring\u003e",
    "finalUrl": "\u003cstring\u003e",
    "status": "\u003cstring\u003e",
    "hasSecurityTxt": "\u003cstring\u003e"
  }
]

API example

$curl --request POST   'https://api.apify.com/v2/acts/5jcFA2uhR3HJLAMTK/runs?waitForFinish=120&maxTotalChargeUsd=0.05'   --header "Authorization: Bearer $APIFY_TOKEN"   --header 'Content-Type: application/json'   --data @input.json

Measured cost and limits

The proof run took 6.33 seconds and reported $0.001438 in platform usage. Actual cost depends on input size and source behavior. Set an Apify maximum charge per run and conservative result limits.

Known limits:

• Public sources can change or become unavailable.
• Output completeness depends on the supplied input.
• The measured proof cost is evidence for one run, not a universal quote.

Run Security.txt Checker — Security Contact Finder on the Apify Store.