The guidance provided about CRA is difficult to follow and does not in any reasonable way cover proportional guidance for SMEs as it claims to do, but it seems websites/server side products are not subject to CRA as they are not considered digital products executing on consumer systems?
The only websites that should require it are the ones that provide downloadable software or software that is used on digital products. And it seems that European alternatives site lists primarily (pure) SaaS and only a few others?
We did something similar few days ago. https://cradata.eu/datasets#cra-exposure-study-2026
Almost identical results:
Across all 342 manufacturers
Publish a valid RFC 9116 security.txt 24 of 342 or 7%
Publish any security.txt 34 of 342 or 9.9%
Publish a discoverable CVD policy20 of 342 or 5.8%
Publish neither, confirmed by observation 257 of 342 or 75.1%
Recently I let claude write a script to export some data from a website. While testing the script I came across a bug that leaked the e-mail address of other users, potentially also more data related to the session.
Upon discovery Claude did recommend to check for a security.txt, but none was available. Sent a mail to their support instead. A security.txt with further instructions and maybe a PGP key would have been nice…
The only websites that should require it are the ones that provide downloadable software or software that is used on digital products. And it seems that European alternatives site lists primarily (pure) SaaS and only a few others?