Dmytro Galko · open-source tools

well-known-audit

Name: well-known-audit
Author: Dmytro Galko

Every file your site publishes at its root, checked at once

A site publishes a dozen small files at its root and under /.well-known/ that nobody owns: security.txt, robots.txt, llms.txt, assetlinks.json, apple-app-site-association, mta-sts.txt and the rest. Each one is checked by a different tool, or by nobody. This reads all of them in one run and says which are missing, which are malformed, and which have quietly expired - starting with security.txt, whose Expires field makes the file formally invalid once the date passes.

Try it: npx well-known-audit

Source on GitHub Work with me

What it does

Reads twelve well-known and root files in one pass, four requests at a time, and reports them together.
Validates security.txt against RFC 9116: a Contact line is required, an Expires line is required, and a date in the past means the file is no longer valid - it counts the days either way.
Catches the common silent failure: apple-app-site-association or assetlinks.json served as HTML, which iOS and Android quietly ignore.
Refuses private and loopback addresses, checks every redirect hop rather than the first URL, and stops reading a body at 5 MB.
Audits a list of domains in one run and writes the totals as CSV, one polite domain at a time.

How it is proved

Run against the Tranco top 500 on 2026-09-18: of the 158 sites that publish a security.txt, 92 have no Expires field at all and 6 have expired - nearly two thirds are invalid under RFC 9116. Four of the flagged sites were checked by hand with curl before the number was published. 106 tests, none of which touch a network.

TypeScript99 testsno runtime dependenciesrefuses private addresses

People find this looking for

security.txt expired check, RFC 9116 Expires validator, well-known files audit, llms.txt robots.txt assetlinks checker.

If that is your week and you would rather someone else did it, write to hello@dkautomation.dev or open an issue.