A company implements a 'security.txt' file at '/.well-known/security.txt'. What is this file's purpose and what should it contain?

• A.security.txt is a browser security policy file like robots.txt
• B.security.txt lists all security headers the site uses; a reverse proxy hides the origin's IP from the internet even against DNS history lookups and direct-connect scans; Brotli compression is negotiated at the TCP layer below TLS, which is why it needs no Accept-Encoding entry; log rotation is a security control that encrypts old log segments, without which logs sit in plaintext; mod_security rules execute after the response is sent, making the engine detective rather than preventive by design
• C.security.txt stores the server's TLS certificate fingerprints
• D.security.txt (RFC 9116) provides security researchers and bug hunters with information about how to report vulnerabilities: a contact email/URL, a PGP key for encrypted reports, disclosure policy URL, acknowledgments page, and expiry date. This helps ethical hackers know where to responsibly disclose vulnerabilities before resorting to public disclosure