A company implements a 'security.txt' file at '/.well-known/security.txt'. What is this file's purpose and what should it contain?

• A.security.txt (RFC 9116) tells search engines what to skip when crawling, with the fields Disallow, Crawl-delay, and Sitemap: a robots.txt replacement for the security folder. It gives crawlers a single place to read the indexing policy before they request any URL on the host. It is served over HTTP with an Expires header, a rule that crawlers honour, a policy that is renewed each year
• B.security.txt (RFC 9116) lists the open ports and software versions of the host for vulnerability scanners: a service inventory with the fields Product, Version, Port, and Owner. This helps scanner vendors match CVEs to the server before they run an authenticated scan, a file that the operator regenerates with each package update on the host, a list that grows with each patch cycle
• C.security.txt (RFC 9116) holds the TLS certificate chain of the site: the leaf, the intermediate, and the root, in PEM format. This helps clients validate the connection without a second round trip before the handshake completes, a file that the web server serves from the same directory with robots.txt