Fields: Contact (required, one or more mailto:, https: or tel: URIs) and Expires (required, an RFC 3339 date-time, recommended less than a year ahead), plus optional Encryption (a key location), Acknowledgments, Policy, Hiring, Preferred-Languages and Canonical. The file must be served over HTTPS and may be signed with an OpenPGP cleartext signature.
A forgotten Expires date is the most common defect: an expired file signals that the contact may be stale. The security.txt tool generates and checks the file.