Is /.well-known/security.txt actually worth publishing?

Yes. RFC 9116 defines a standard text file at /.well-known/security.txt telling researchers + automated scanners where to report findings before they go public.

The 30-line file looks like:

Contact: mailto:security@yourstore.com
Contact: https://yourstore.com/security/report
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://yourstore.com/.well-known/security.txt
Policy: https://yourstore.com/security/disclosure-policy
Acknowledgments: https://yourstore.com/security/hall-of-fame

What it buys you:

• Researchers report responsibly: A good-faith researcher who finds an XSS bug will email security@ before tweeting it. Without security.txt they hunt for a contact, get frustrated, and often just disclose publicly.
• Bug-bounty platforms find you: HackerOne, Bugcrowd, and Intigriti all check security.txt to know where to route reports for your domain.
• Compliance frameworks credit it: ISO 27001, NIST CSF, and several PCI compensating controls reference a documented vulnerability-disclosure policy.

Cost: $0. Effort: 1 hour to write + deploy. The audit’s q22 rewards a current (non-expired) security.txt with at least a Contact and an Expires line. Update annually.