diff --git a/common/well-known/security.txt b/common/well-known/security.txt
new file mode 100644
index 000000000..3b83d3bf9
--- /dev/null
+++ b/common/well-known/security.txt
@@ -0,0 +1,2 @@
+# Report security issues responsibly
+Contact: admin+security@inrupt.com
diff --git a/lib/create-app.js b/lib/create-app.js
index a44b5833f..90bfcc832 100644
--- a/lib/create-app.js
+++ b/lib/create-app.js
@@ -56,6 +56,7 @@ function createApp (argv = {}) {
   app.use('/common', express.static(path.join(__dirname, '../common')))
   routeResolvedFile(app, '/common/js/', 'mashlib/dist/mashlib.min.js')
   routeResolvedFile(app, '/common/js/', 'mashlib/dist/mashlib.min.js.map')
+  app.use('/.well-known', express.static(path.join(__dirname, '../common/well-known')))
 
   // Add CORS proxy
   if (argv.proxy) {