A researcher finds a vulnerability and needs to reach someone who can fix it. A support form might work. A general inbox might forward the message. A published security contact removes some of that guesswork.
On June 3, 2026, we checked for security.txt across .ch domains in two public ranking lists. About 1 in 10 of the sampled domains returned a file containing a Contact: field.
What we measured
| Sample | Domains checked | File found with a Contact field |
|---|---|---|
| Majestic Million, full .ch subset | 4,188 | 9.4% |
| Tranco, highest-ranked 3,000 .ch domains | 3,000 | 10.7% |
The samples came from the Majestic Million and Tranco. These are ranked-domain samples, not a census of Swiss organizations. They may overlap, so their sizes shouldn’t be added into a count of unique sites.
We fetched /.well-known/security.txt, followed redirects, and looked for a Contact: field. This was a file-discovery check. It didn’t test whether someone monitored the contact, whether the file met every requirement, or whether a vulnerability disclosure program worked.
The percentages describe that June snapshot. They aren’t a fresh measurement of today’s sites.
Absence doesn’t mean unreachable
Our earlier wording described sites without the file as having no way to receive a report. That went beyond the data. A company can publish a security page, operate a reporting program elsewhere, or handle reports through another contact.
The narrower finding is still useful: the standard discovery location was missing from most domains we sampled. Researchers visiting those domains needed another route.
Nor did the survey measure how long vulnerabilities remained unreported or which companies were more secure. Those questions require different evidence.
Redirect handling changed an early result
An initial check on a separate large-company set reported 8% coverage. Following redirects raised that result to 48%. This correction concerned that separate set, not the 4,188-domain sample above.
It exposed an avoidable measurement error. A collector that treats a redirect as an absent file can underestimate adoption substantially. Timeouts and unexpected responses also need their own categories when interpreting a snapshot.
Publish a contact someone maintains
RFC 9116 describes the file format. For websites, serve it over HTTPS at /.well-known/security.txt. Include a reporting contact and an expiry date, and update the file before it expires.
This illustrative file needs a real address and a maintained expiry date before use:
Contact: mailto:[email protected]
Expires: 2027-03-01T00:00:00Z
Preferred-Languages: ensecuritytxt.org provides a generator. Assign someone to monitor the reporting route and keep the file current. Publishing the file helps a researcher find you; responding to the report is the work that follows.