security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail