Add /.well-known/security.txt

[github-throwaway]

A security.txt file serves as a standardized method for organizations to specify their vulnerability disclosure policies. By placing this file in a well-known location, security researchers can easily identify the appropriate channels to report potential security issues. This proactive approach not only streamlines the reporting process but also demonstrates a commitment to security best practices.

https://securitytxt.org/

What fields should be populated? Probably just the email I suppose? Here is Googles version:

Contact: https://g.co/vulnz
Contact: mailto:[email protected]
Encryption: https://services.google.com/corporate/publickey.txt
Acknowledgments: https://bughunters.google.com/
Policy: https://g.co/vrp
Hiring: https://g.co/SecurityPrivacyEngJobs
Expires: 2025-04-01T00:00:00z