We try to place a security.txt in the .well-known directory. But the file will not be found because of the .htaccess blockage.
https://securitytxt.org/
Create a .well-known/security.txt and try to visit it. You will get a 404.
Remove the blockage of .well-known in the first line of the .htacccess
Postponed: needs info
11.0 🔥
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I recently added the .well-known/apple-developer-merchantid-domain-association to a site and ran into this issue while troubleshooting that process. I agree with #3 that this change doesn't seem necessary, so I'm adjusting the status.
If there's no feedback explaining why this change is necessary within a few weeks I think the issue could be closed.