Exposure · Check
security.txt Canonical mismatch — pointing back to the right URL
The `Canonical:` field in security.txt should match the URL where the file actually lives. A mismatched value confuses researcher tooling and can be a sign of a stale file copied between hosts.
Real-world risk
Clients that fetch the Canonical URL may not see the same disclosure file as the host you scanned, causing confusion during incidents.
Fix steps (in order)
- Set Canonical: to the primary URL where security.txt is maintained, or serve identical content on both hosts.
- Prefer /.well-known/security.txt as the single source of truth.
Verify the fix in 30 seconds
Run a Scorifya scan on the affected host after deploy. The same finding id (security_txt_canonical_mismatch) clears once the externally-observable signal is in place.