What security.txt is for
When someone finds a vulnerability in your site, the hard part is often finding out whom to tell. security.txt (RFC 9116) is a short text file at /.well-known/security.txt that answers that: a Contact line with an e-mail address or a reporting page, and an Expires line that says until when the information may be relied on. Both are required. Optional fields add an encryption key, the disclosure policy, preferred languages, the canonical URL of the file, a link to acknowledgments and security job openings.