Meh. Well known records (robots.txt, everything under .well-known/, etc) are meant to be used by automated systems IMO. The only automated system that would eve

Meh. Well known records (robots.txt, everything under .well-known/, etc) are meant to be used by automated systems IMO. The only automated system that would ever use this is email harvesters. You can find our security contact in the whois record for our domain, or through the "vulnerability reporting" link in the footer of our homepage. Good enough.