Hmm wondering how common some of these are ... I'd love /.well-known/change-password but it looks like https://news.ycombinator.com/.well-known/change-password and google.com/.well-known/change-password don't seem to be implemented?
security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail
security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail