security.txt missing required Contact field

This check looks at the site's /.well-known/security.txt file, the standard place security researchers check first when reporting a vulnerability, for a required 'Contact:' field naming how to actually get in touch. On this site, a security.txt file exists, but it's missing this required field. RFC 9116, the standard that defines security.txt, requires the Contact field; without it, the file is considered non-compliant, and more practically, a researcher who finds a genuine security issue has no path to tell the business about it before deciding what else to do with that information. Your developer should add a line such as 'Contact: mailto:security@yourdomain.com' to the existing /.well-known/security.txt file. Since the file already exists, this is a one-line addition, roughly a minute or two of actual work once someone has access to edit it.