> especially if I have a bug bounty program that attracts low quality bug reports IMO security.txt provides value for when you DON'T have a bug bounty program.

> especially if I have a bug bounty program that attracts low quality bug reports IMO security.txt provides value for when you DON'T have a bug bounty program. If you don't already have a 'front door' for how to send you security information, you're not going to get it. Also, I would put some money on someone finding a show stopper bug like shellshock/heartbleed/deserialization-bug-of-the-week/etc and contacting folks from their security.txt in sync with their public release sometime within the next few years.