Free tool
security.txt finder
Free security.txt finder: check /.well-known/security.txt and /security.txt for a published vulnerability contact.
security.txt (RFC 9116) publishes a security contact, usually at /.well-known/security.txt. Researchers look here before cold-emailing abuse@ guesswork addresses.
Where we look
We try /.well-known/security.txt then /security.txt over HTTPS. A valid file typically includes a Contact: field.
Why publish one
Clear contacts speed vulnerability reports and show operational maturity. Keep Expires: updated so the file does not go stale.