there is a draft (from November 27, 2019) that makes the presence of a disclosure policy (using security.txt) mandatory on gov domains: "Binding Operational Di

there is a draft (from November 27, 2019) that makes the presence of a disclosure policy (using security.txt) mandatory on gov domains: "Binding Operational Directive 20-01 Develop and Publish a Vulnerability Disclosure Policy" https://cyber.dhs.gov/bod/20-01/ https://cyber.dhs.gov/bod/20-01/ > Create a security.txt15 file at the “/.well-known/” path16 of the agency’s primary .gov domain. This file must include the Policy and Contact fields, as specified in the Internet-Draft.17