%% You should probably cite rfc9116 instead of this I-D. @techreport{foudil-securitytxt-08, number = {draft-foudil-securitytxt-08}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-foudil-securitytxt/08/}, author = {Edwin Foudil and Yakov Shafranovich}, title = {{A Method for Web Security Policies}}, pagetotal = 24, year = 2019, month = nov, day = 20, abstract = {When security vulnerabilities are discovered by independent security researchers, they often lack the channels to report them properly. As a result, security vulnerabilities may be left unreported. This document defines a format ("security.txt") to help organizations describe the process for security researchers to follow in order to report security vulnerabilities.}, }