“When security risks in web services are discovered by independent security researchers who understand the severity of the risk, they often lack the channels to disclose them properly. As a result, security issues may be left unreported. security.txt defines a standard to help organizations define the process for security researchers to disclose security vulnerabilities securely.”
Also SIDN, the once that regulate everything for the .NL tld, want to give discounted prices for people that use the security.txt
