My org doesn’t host a security.txt file because the security@example.com email address been standardized since 1997:

https://www.rfc-editor.org/rfc/rfc2142