still 404 but the standard is .well-known/security.txt