Create a security.txt file at /.well-known/security.txt

A security.txt file addresses a genuine, practical problem in vulnerability disclosure — a security researcher who discovers a genuine vulnerability in your systems needs a clear, reliable way to report it responsibly, and without this file, they're often left guessing at an appropriate contact method, which can lead to delayed reporting, public disclosure before you're aware, or simply the researcher giving up on responsible reporting entirely.

This file, published at the specific, standardized location browsers and security tools know to check, provides genuine, structured contact information specifically for security reports — distinct from a general contact form or customer support channel, which security researchers reasonably assume may not route urgent vulnerability reports to the right technical team quickly.

The genuine practice of maintaining a responsible disclosure channel signals real security maturity to the broader security research community — organizations known to have functioning, monitored security contact channels are more likely to receive good-faith vulnerability reports before any malicious exploitation occurs, rather than researchers defaulting to public disclosure due to no clear private reporting path.

This file requires minimal ongoing maintenance once established, but genuine value depends on the contact information remaining current and, critically, actually monitored — a security.txt file pointing to an unmonitored or abandoned contact method provides false reassurance while still failing at the actual goal of enabling real vulnerability disclosure.