Provide public security contact information
DETAILS: Tier: Free, Premium, Ultimate Offering: Self-managed
- Introduced in GitLab 16.7.
Organizations can facilitate the responsible disclosure of security issues by
providing public contact information. GitLab supports using a
security.txt
file for this purpose.
Administrators can add a security.txt
file using the GitLab UI or the
REST API.
Any content added is made available at
https://gitlab.example.com/.well-known/security.txt
. Authentication is not
required to view this file.
To configure a security.txt
file:
- On the left sidebar, at the bottom, select Admin area.
- Select Settings > General.
- Expand Add security contact information.
- In Content for security.txt, enter security contact information in the format documented at https://securitytxt.org/.
- Select Save changes.
For information about how to respond if you receive a report, see Responding to security incidents.
security.txt
file
Example The format of this information is documented at https://securitytxt.org/.
An example security.txt
file is:
Contact: mailto:security@example.com
Expires: 2024-12-31T23:59Z