Recently, @ant0inet (Antoine) tweeted about a cursory scan they did against the .ch TLD to determine how many security.txt files are hosted on the .ch zone.

I decided it would be fun to explore the data set of $288$ security.txt files.

If you have scanned for security.txt files in the past, you are probably aware that a significant portion of these files are hosted by the underlying product used for hosting the website. For instance, Tumblr user websites host a generic security.txt file pointing to Automattic’s HackerOne programme.

Contact: https://hackerone.com/automattic/reports/new
Policy: https://hackerone.com/automattic
Acknowledgments: https://hackerone.com/automattic/thanks
Hiring: https://www.tumblr.com/jobs

If we create a hash map of security.txt files from Antoine’s resulting data set, we discover there are several duplicate files. Some of these duplicate files are organisational security.txt files hosted across a collection of .ch hosts belonging to one company.

Bar graph of duplicate security.txt files
Post AG hosts the most security.txt files on the .ch zone

OrganisationNumber of security.txt files
Post AG$54$
Nextcloud$30$
bpm$19$
Readymag$15$
Visana$7$
edoobox$5$
Procter & Gamble$3$
Google$2$
Zera Media$2$

Using the same data set, we can fetch the number of unique security.txt files by returning the length of the hash map. This results in $143$ unique security.txt files across the .ch zone.

It may help to further illustrate the proportion of unique to duplicate files.

Ratio of duplicate to unique security.txt files

As noted by Antoine in later tweets, some hosts were missing from the initial data set due to massdns not resolving them and the nuclei template not following redirects (this has since been updated).

Antoine released a final more refined data set which addressed the issues faced with earlier scans. This data set included $1310$ security.txt files.

Performing the same analysis against this new data set returned $535$ unique security.txt files.

Ratio of unique to duplicate security.txt files

Post AG came out top hosting a total of $203$ Instances of security.txt.

OrganisationNumber of security.txt files
Post AG$203$
Nextcloud$125$
Readymag$55$

All in all, kudos to Antoine for taking the time to scan the .ch zone for security.txt. This was a fun exercise and uncovered some interesting insights into security.txt adoption in Switzerland. I look forward to seeing adoption grow among Swiss organisations in the years to come.