RFC 9116: security.txt for your PHP apps

Table of Contents The problem: a locked door with no doorbell What security.txt is (RFC 9116) Why it matters: lower the barrier, route to the right channel Our take: a CakePHP middleware that never goes stale Pair it with a SECURITY.md Try it today … and how we automated it in CakePHP Most security incidents do not start with a genius attacker. They start with an honest person who found something and could not figure out how to tell you. If reporting a bug is harder than tweeting about it, you have quietly chosen public disclosure for them. At the same time AI makes it possible to even automate security testing on a scale we have not seen before. Every single day now there is a vulnerability found (and reported) somewhere out there. security.txt fixes the boring part of that problem: it tells finders exactly where to send a report. This post covers what the standard is, why lowering the reporting barrier matters, and how we turned it into a one-liner for CakePHP apps with an…