| public_dir | Directory to write security.txt (default: dist). File will be placed in .well-known/ subdirectory per RFC 9116. | no | dist |
| site_url | Public base URL of the site, e.g., https://example.com. Used for canonical URI (optional). | no | — |
| security_contact | Contact method(s) for security vulnerability reports (REQUIRED per RFC 9116). Comma-separated list. Must be a URI: mailto:, https://, or tel:. Auto-converts emails. Example: security@example.com,https://example.com/security | yes | — |
| security_expires | Expiration date for security.txt validity. Formats: ISO 8601 (2026-12-31T23:59:59Z), days (180d), months (6m), years (1y). Default: 180d (6 months). RFC 9116 recommends < 1 year (365 days). | no | 180d |
| security_acknowledgments | Optional: URL(s) to security researchers hall of fame page. Must use https://. Comma-separated for multiple. | no | — |
| security_canonical | Optional: Canonical URI(s) where this file is located. Must use https://. Auto-generated from site_url if not provided. Comma-separated for multiple. | no | — |
| security_encryption | Optional: URL(s) to OpenPGP encryption key for secure communication. Must use https:// or openpgp4fpr: scheme. Comma-separated for multiple. | no | — |
| security_hiring | Optional: URL(s) to security-related job postings. Must use https://. Comma-separated for multiple. | no | — |
| security_policy | Optional: URL(s) to vulnerability disclosure policy page. Must use https://. Comma-separated for multiple. | no | — |
| security_preferred_languages | Optional: Comma-separated language codes for preferred report languages (e.g., "en, es, fr"). Uses RFC 5646 language tags. | no | — |
| security_comments | Include RFC 9116 reference comments at the top of security.txt | no | true |
| upload_artifacts | Upload generated security.txt as GitHub artifacts | no | true |
| artifact_name | Name of the GitHub artifact when upload_artifacts is enabled | no | securitytxt |
| artifact_retention_days | Number of days to retain the artifact (1-90). Leave empty for default (35 days) | no | — |
| debug | Debug: Display generated security.txt content | no | false |