Some years ago I learned about security.txt, a proposed document that could be added to a website to let security researchers know who to contact in the event a security concern is found. It’s a really cool proposal, and you should definitely check it out. This proposal also showed me the /.well-known/ folder, since that’s where security.txt is supposed to be placed.

/.well-known/, also known as RFC 8615, is a URI intended to be the store for documents/files/paths/etc. that web servers can be expected to contain. Had robots.txt come out after this RFC, I think it can be safely assumed that it would be placed in the .well-known folder.

It makes me sad, then, when I see new standard files for web servers, such as humans.txt and humans.json, not use this folder. I know that RFC’s, and standards in general, aren’t hard and fast rules. This is the internet - nobody’s going to make you do anything. But, like, it’s right there! Plus, I don’t love having a dozen text documents just hanging out in my root folder.

This post is just a complaint into the void. I wish more standards-makers would use /.well-known/. That’s all.