Security.txt
Suggested for policy inclusion for CNA (CVE Numbering Authority) guidelines. And yes, I would suggest they remove the disclosure policy, it's not really all that germane for the vendor, from the security researchers point of view.<p>Edit: forgot link: <a href="https://github.com/CVEProject/docs/issues/53" rel="nofollow">https://github.com/CVEProject/docs/issues/53</a>