When a site publishes no security contact, lookup.disclose.io says so plainly: "No first-party reporting route found." Constructed security@ ranks before abuse@, both labeled unverified, and a CERT route stays a real coordination path. And fewer results end there now. #VulnerabilityDisclosure
