Contact: mailto:security@[DOMAIN]
Expires: [ONE YEAR FROM PUBLICATION, ISO 8601 e.g. 2027-09-01T00:00:00.000Z]
Preferred-Languages: en
Canonical: https://[DOMAIN]/.well-known/security.txt
Policy: https://[DOMAIN]/security