A link or e-mail address for people to contact you about security issues. Remember to include "https://" for URLs, and "mailto:" for e-mails. See the full description of Contact

• Each contact field must begin with https:// for web URIs; tel: for telephone numbers; or mailto: for e-mails.

The date and time when the content of the security.txt file should be considered stale (so security researchers should then not trust it). Make sure you update this value periodically and keep your file under review. See the full description of Expires

A link to a key which security researchers should use to securely talk to you. Remember to include "https://". See the full description of Encryption

A link to a web page where you say thank you to security researchers who have helped you. Remember to include "https://". See the full description of Acknowledgments

A comma-separated list of language codes that your security team speaks. You may include more than one language. See the full description of Preferred-Languages

The URLs for accessing your security.txt file. It is important to include this if you are digitally signing the security.txt file, so that the location of the security.txt file can be digitally signed too. See the full description of Canonical

A link to a policy detailing what security researchers should do when searching for or reporting security issues. Remember to include "https://". See the full description of Policy

A link to any security-related job openings in your organisation. Remember to include "https://". See the full description of Hiring

A link to the provider-metadata.json of your CSAF (Common Security Advisory Framework) provider. Remember to include "https://". See the full description of CSAF