It works in Safari and Chrome it looks like: https://web.dev/articles/change-password-url

I've never heard of it actually being used, though.

Google's URL is on https://accounts.google.com/.well-known/change-password but not on their main domain.

security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail