Security.txt

Publish a security.txt File for Vulnerability Reports

A security flaw can be reported only if the person who finds it can locate a usable reporting route. When that route is buried in a support portal, points to an abandoned mailbox, or varies across domains, a valid report can be delayed or sent to the wrong place. security.txt gives a web service a standard place to publish vulnerability-reporting contact details. The file is deliberately small. Its value comes from making the route predictable and keeping the route operational.