RFC 9116 security.txt has two hard rules teams routinely break: Contact is mandatory and Expires must be in the future. An expired file is worse than none — researchers assume the channel is dead.

SecurityTxtEditor edits the full RFC surface (Contact list, Expires date input, Encryption / Acknowledgments / Preferred-Languages / Canonical / Policy / Hiring) with validateSecurityTxt surfacing violations inline as you type.

Controlled value + onChange over a SecurityTxtModel; pair with <XFilePreview kind="securityTxt"> and serve the rendered text at /.well-known/security.txt via the fancy-x-files backend.