“security.txt defines a standard to help organizations define the process for security researchers to disclose security vulnerabilities securely.”
Researchers find a hole and then spend days hunting for someone to tell. A text file at a fixed path fixes that for the price of five minutes. Google, GitHub and the UK government already publish one. Every company that skips it is choosing not to hear about its own bugs.