security.txt

HuggingFace serves a disclosure channel, not a control

HuggingFace's security.txt defines a disclosure channel, not a security control. Publishing it expanded the commitment surface, not the platform's defenses.