On security.txt:
I understand that staleness may exist in companies and a security contact should be reachable. but why is the solution an EXPIRES field that has to be updated once a year?
- https://datatracker.ietf.org/doc/html/rfc9116#name-expires
People will just automate the task of changing the date of the EXPIRES field instead of changing the contact in their aliases file.
It does not change anything if the date did not expire but nobody is reading [email protected].

RFC 9116: A File Format to Aid in Security Vulnerability Disclosure
When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported. This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.


