fix: add /.well-known/security.txt

[mpot37]

Summary

Fixes the "security.txt" severe finding from the check.outrun.at GEO audit -- /.well-known/security.txt currently 404s.

Verified locally with mint dev that Mintlify serves arbitrary static files placed in the repo the same way it already serves robots.txt and llms.txt -- adding this file locally produced a clean 200 with the expected content. Should carry through to production the same way, though (like any static-file behavior) worth a live check after deploy.

⚠️ Needs a decision before merging

The Contact: field is currently a placeholder (security@request.network) -- I don't have a way to confirm that inbox exists or is monitored, and a security.txt pointing at a dead address is arguably worse than not having one. Please confirm the real contact (could be this address, a different one, or a link to a HackerOne/Bugcrowd program) before merging. Marking this PR as a draft for that reason.

Contact: mailto:security@request.network
Expires: 2027-08-14T00:00:00.000Z
Canonical: https://docs.request.network/.well-known/security.txt

Test plan

• mint dev locally, confirmed /.well-known/security.txt returns 200 with exact file content
• Confirm real Contact: address
• After merge + deploy, confirm https://docs.request.network/.well-known/security.txt returns 200

[greptile-apps]

Greptile Summary

Adds a static /.well-known/security.txt endpoint for the documentation site.

• Publishes a mail-based security contact.
• Sets an expiration date and canonical URL.

Confidence Score: 5/5

The PR appears safe to merge once the explicitly documented contact-address decision is completed.

No blocking failure remains from the eligible follow-up findings.

Important Files Changed

Filename	Overview
.well-known/security.txt	Adds the three standard fields needed to publish the documentation site's security contact metadata.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into add-security-tx..." | Re-trigger Greptile}

[mpot37]

⚠️ Update: I tested this locally with `mint dev` and got a clean 200 for `/.well-known/security.txt` with the expected content, which is what the PR description above is based on. Mintlify support has since told us directly: "Mintlify only serves robots.txt and sitemap.xml as custom root files. No way to add arbitrary /.well-known/ paths."

Those two signals conflict -- most likely explanation is that `mint dev`'s local server serves the repo more permissively than whatever route-bundling production actually does. I'd trust Mintlify's own statement about their production behavior over a local-only test.

Recommend holding this PR until that's resolved one way or the other -- either a staging/preview deploy confirms the file is actually reachable in production, or Mintlify confirms local dev really does differ from prod here. Don't merge on the strength of the local test alone.