1. 3

https://securitytxt.org/ got published as an RFC