security.txt file exists

Without a security.txt, researchers who discover vulnerabilities in your app have no official channel to report them — they either give up, post publicly, or sell the finding. RFC 9116 defines the standard that security teams, automated scanners, and responsible-disclosure platforms use to find contact information. ISO 27001:2022 A.5.5 includes coordinated vulnerability disclosure as a required control for information security management. A missing security.txt means a researcher who found your SQL injection is more likely to submit it to a bug bounty aggregator or post it to social media than reach you first — costing you the ability to patch quietly.

Create public/.well-known/security.txt with at least a Contact: directive and an Expires: date per RFC 9116. The file is served as a static asset by Next.js automatically.

# public/.well-known/security.txt
Contact: mailto:security@yoursite.com
Expires: 2026-12-31T23:59:59Z
Preferred-Languages: en
Policy: https://yoursite.com/security-policy

Set Expires about a year out and update it annually. If you have a HackerOne or Bugcrowd program, use that URL as the Contact: value instead of a raw email. Verify the file is accessible at https://yoursite.com/.well-known/security.txt after deployment.