FWIW, security.txt is placed in .well-known/