Hugging Face Maintains RFC 9116 Security Contact File
A community submission highlighted Hugging Face's standard security contact file hosted at `huggingface.co/security.txt`. The file provides standardized contact details and reporting guidelines for vulnerability researchers. Maintaining a standard security contact file ensures independent ethical hackers can safely and directly report security vulnerabilities to Hugging Face. As AI infrastructure platforms grow in importance, implementing standard security disclosure practices is essential for ecosystem trust. The submission points to standard web security compliance following RFC 9116 rather than a novel security tool or vulnerability disclosure. It provides a machine-parsable format for researchers to locate security practices and communication channels.
## BACKGROUND
Defined in RFC 9116, `security.txt` is an IETF-accepted standard format intended to help organizations describe their vulnerability disclosure practices. Similar to how `robots.txt` serves web crawlers, `security.txt` allows security researchers to easily find contact details and PGP keys in a predictable location.