Checks

security.txt returned an error

/.well-known/security.txt answered with an HTTP error other than 404.

Why it matters

The file is not usable as a disclosure contact.

What to do

Serve the file with HTTP 200 and a text body.

Reference

A published security.txt supports coordinated vulnerability disclosure.

RFC 9116 — security.txt