News
humans.txt vs security.txt on Public Marketing Sites
May 18, 2024
humans.txt vs security.txt on public marketing sites is two small text files with different jobs. humans.txt (usually /humans.txt) is an informal credits list: names, roles, tools, sometimes a 'last updated' line. It is branding, not a control. security.txt lives at /.well-known/security.txt (RFC 9116) and tells researchers where to send a report. Mixing them is how teams paste a personal email into humans.txt and ignore Contact in security.txt — or list an intern in credits who still has production SSH. Neither file authenticates anyone or hides /.env. RoastMyOpsec does not require humans.txt or security.txt and does not score a missing credits file as an F.
The practical difference
security.txt is machine-readable disclosure: Contact, Expires, optional Policy. humans.txt is a thank-you note. OpenID discovery and the web app manifest are other public catalogs. Do not put credentials, internal hostnames, or 'we use this exact CMS version' inventories in humans.txt.
A /security HTML page is still useful for humans. See security.txt vs a public contact page.
How to choose what to publish
If you will read reports: ship security.txt with a mailbox you monitor. humans.txt is optional; keep it to first names or roles if you publish it, not home addresses. If legal needs a policy URL, put it in security.txt Policy, not only in a poem at /humans.txt. Do not list a personal Gmail you will abandon in either file.
| File | Job | Typical miss | Takeaway |
|---|---|---|---|
| /.well-known/security.txt | Researcher intake | Stale Contact; no Expires | Publish if you will actually read it |
| /humans.txt | Credits / culture | Personal emails, stack résumé | Optional; keep it bland |
| openid-configuration | IdP metadata | Internal issuer URLs | See OpenID vs security.txt |
| Web app manifest | PWA install metadata | Over-sharing app names | See manifest vs public metadata |
When humans.txt still wins
It wins as a light credits page with no PII and no version pins. security.txt always wins as the disclosure channel. Missing humans.txt is healthy. Missing security.txt is a missed inbox, not a roast F.
What the roast can prove
Neither file is a scored vulnerability miss. Confirm Contact yourself. Pair with consent-based scanning: do not roast third-party sites as 'research' just because their humans.txt listed a name.
Common mistakes
The first mistake is putting the security mailbox only in humans.txt where parsers will not look.
The second mistake is a humans.txt that names every vendor and CMS version.
The third mistake is treating a missing humans.txt as an OPSEC finding.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need humans.txt for SEO or security?
- No. It is optional credits. security.txt is the disclosure file researchers look for.
- Can humans.txt replace security.txt?
- No. RFC 9116 parsers look at /.well-known/security.txt. Credits will not be found as Contact.
- Does RoastMyOpsec require either file?
- No. Missing humans.txt is not an F. security.txt is also not required to pass.