d4 · tools · security.txt
Enter a domain and our server fetches its security.txt and checks it against RFC 9116: the canonical /.well-known/ location, a text/plain content type, a reachable Contact, an Expires date that has not passed, and whether the file is PGP signed. Each result is explained in plain English. Nothing you look up is logged.
The validator fetches only /.well-known/security.txt (falling back to the legacy /security.txt) over HTTPS, follows at most five redirects, only ever connects to publicly routable addresses, and is rate limited. It checks the file against RFC 9116 but does not verify PGP signatures or that contact addresses are monitored. Lookups are not logged.