GET /.well-known/security.txt
RFC 9116 compliant security.txt. Expires field is in the future, Contact URL resolves, Canonical matches the served URL. Validators should accept without warnings.
expect: 200 OK, Content-Type: text/plain. All required fields present and valid per RFC 9116.
headers
body