Facebook have the security.txt at root: https://facebook.com/security.txt https://facebook.com/security.txt Both Facebook and Apple also use [URL]/.well-known/

Facebook have the security.txt at root: https://facebook.com/security.txt https://facebook.com/security.txt Both Facebook and Apple also use [URL]/.well-known/security.txt The contact on Facebook don't work: https://www.facebook.com/whitehat/report/ https://www.facebook.com/whitehat/report/