Security.txt
Suggested for policy inclusion for CNA (CVE Numbering Authority) guidelines. And yes, I would suggest they remove the disclosure policy, it's not really all that germane for the vendor, from the security researchers point of view.Edit: forgot link: https://github.com/CVEProject/docs/issues/53