Already shared this cybersec advice elsewhere but I feel this deserves to be more widespread.
RFC 9116 allows you to add security.txt, a plain text file served over HTTPS at /.well-known/security.txt with two required fields. That's the whole standard!
# https://example.com/.well-known/security.txt Contact: mailto:security@example.com Expires: 2027-01-01T00:00:00.000Z Policy: https://example.com/security-policy Preferred-Languages: en, fr
commit 3302847