76% of 623 EU software vendors have no security.txt ahead of the CRA 24h rule

Those of you who publish a security.txt - how many reports do you get, and what's the typical quality level?

If I push to add one to my employer's website, will our security team thank me for doing so?

What is the difference?

https://securitytxt.org/

For those on Cloudflare, it's a toggle to enable this and provide the necessary values.

https://developers.cloudflare.com/security-center/infrastruc...