A standard text file at /.well-known/security.txt tells security researchers how to report vulnerabilities. It is cheap to publish and dramatically lowers the bar for responsible disclosure.
RFC 9116 — A File Format to Aid in Security Vulnerability Disclosure
RFC 8615 — Well-Known Uniform Resource Identifiers (URIs)