While if its just a text file in .well-known, certainly couldnt hurt.

Im kind of doubtful people will actually look at it though. It strikes me more as a wannabe standard than an actual standard.

Indeed, I did say it was a draft ;) - https://tools.ietf.org/html/draft-foudil-securitytxt-03

I'm still amused/confused how people ("security researchers") find the OTRS emails to send to, but don't try or know of security@domain

Security.txt seems to be gaining a bit more traction
USG: https://twitter.com/GossiTheDog/status/1199785508483801088
Shodan: https://twitter.com/GossiTheDog/status/1199807007219474432

I think it should be reconsidered every couple of years.

• It needs to be investigated whether this is common practice today and we should provide that. Basically also a “webmaster” is to be contacted somehow.
• The individual wiki page is not affected, but a single file per WMF subdomain or just domain could be accessed which may all be redirected to the one and only definition specifying an e-mail address and perhaps Phabricator security report procedure.
• If we could improve security at low cost which is quite easy to maintain we should do that one day. If security detection bots are expecting such URL we might serve; if not commonly used we can postpone it some years agein.

While I’m not necessarily opposed, it’s still only a “proposed standard”.

Yeah, in January 2020 it has been made a step forward by closing the call for comments.

As long as there are no listeners we do not need to shout.

However, for external detectives it is not obvious to understand how a Phabricator Security Bug is to be filed when discovering bad things in Chinese Wikisource.

Since it is no big deal to let a common guide occur on major WMF domains we might provide that in 2022, or reconsider again. We are at top 10 websites in the world and could act as a role model.

As another “standard” emailing security@ works fine for many people.