security.txt returns an HTML app shell instead of RFC 9116 text

security.txt is a standard file, defined by RFC 9116, published at /.well-known/security.txt, that tells security researchers how to responsibly report a vulnerability they find. This check requests that path and looks at what's actually returned. On this site, the URL returns an HTML page, usually the site's normal homepage or app shell, rather than the required plain-text security.txt content. This usually happens because the site's router or application falls back to showing the homepage for any URL it doesn't specifically recognise, including this one. The practical effect is that automated scanners might record a 200 OK success response, while an actual human researcher or compliance tool trying to read the Contact and Expires fields finds only a normal web page with no useful information in it, leaving no working path to report a vulnerability. Your developer should configure the server or application to serve a genuine plain-text file at /.well-known/security.txt, ahead of the general application fallback route, including the required Contact and Expires fields. This is typically about 15 minutes once the routing rule for this specific path is understood.