How to write a security.txt (RFC 9116), and why EU software makers now need one

The two required fields, the useful optional ones, the common mistakes, and why the Cyber Resilience Act makes a working security contact urgent.