When convenient

Security researchers have no way to reach you

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

There is no security.txt file, the standard place to say who to contact if someone finds a vulnerability.

Why it matters

When a well-meaning researcher finds a hole and cannot find you, the next person who finds it may not be well-meaning.

How to fix it

Ask your developer to add a security.txt file with a contact email. It takes five minutes.

For your developer