Why it matters
When a friendly researcher finds a hole in your site, security.txt tells them who to email. Without it, they give up or tweet about it.
How to check it yourself
Visit yoursite.com/.well-known/security.txt. If it's a 404, anyone who finds a hole in your site has no official way to tell you.
What the fix involves
Publish a plain text file at /.well-known/security.txt with a Contact line and an Expires date about a year out.
Reference: securitytxt.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.