https://crossplane.io/.well-known/security.txt returns 404. RFC 9116 makes /.well-known/security.txt the standard, machine-discoverable pointer to a project's disclosure channel. Crossplane already runs a security program (crossplane-security@lists.cncf.io, per SECURITY.md); this just makes it discoverable.
A small security.txt served from the site's static directory would resolve it — glad to send a PR once I know which dir the site serves static assets from. I used AI assistance; I reproduced the 404 myself.
https://crossplane.io/.well-known/security.txtreturns 404. RFC 9116 makes/.well-known/security.txtthe standard, machine-discoverable pointer to a project's disclosure channel. Crossplane already runs a security program (crossplane-security@lists.cncf.io, per SECURITY.md); this just makes it discoverable.A small security.txt served from the site's static directory would resolve it — glad to send a PR once I know which dir the site serves static assets from. I used AI assistance; I reproduced the 404 myself.