security.txt Under CRA: What To Do When Your Product Isn't a Website

Article 14 of the EU Cyber Resilience Act requires every covered product to have a publicly reachable vulnerability reporting contact. The standard guidance everywhere says the same thing: host a secu