Definitely felt like wishful thinking whenever I heard that security.txt was a thing.
From the blog post-
> Of the 666,771 most popular websites on the Alexa list, I found 2,884 security.txt files that were content-type “text/plain” and returned a HTTP 200 status code. Not all of these were valid security.txt files, but most were.
Seems I was right?