responsible disclosure, one line
Someone just found a flaw on your site. Who do they call?
If the answer isn't obvious in ten seconds, the finding goes somewhere else — a thread, a forum, or a buyer. This is one line of HTML that answers the question.
Drop it in your <head>. That's the whole thing.
Why it matters
Most people who find a vulnerability would rather tell you than use it. What stops them is not goodwill — it's the contact form, the support ticket that goes nowhere, the legal page with no name on it.
Friction decides where a finding ends up. Remove the friction and you get the report instead of the incident.
Why a meta tag
There is already a standard for this: security.txt, RFC 9116, a file served from /.well-known/. Use it when you can. It carries more: encryption keys, policy, expiry.
But plenty of sites can't. Shared CMS, hosting managed by a third party, no server access, a template you can edit and nothing else. A meta tag needs none of that. It ships with the page.
The two sit together fine. One file at the root, one line in the head — whichever you can actually deploy today.
Writing the content
Keep it plain and human. Name a mailbox someone actually reads, write the address so a scraper won't harvest it, and say thank you. That's the entire spec.
No schema, no versioning, no registry. If it reads like a note left on a door, it's right.
Found something here?
The tag on this page is real. Use it — we answer.