A standard contact file that tells security researchers exactly how to report a vulnerability responsibly, instead of guessing an email address.
Without it, a researcher who finds a real problem may not know how to reach you safely, or may go public first out of frustration.
A genuine IETF standard, RFC 9116.
Preferred: example.com/.well-known/security.txt (a copy at /security.txt is also common)
Fill this in and download security.txt directly — the same generator lives in the full builder alongside the other 15 files.