generated: '2026-07-18'
method: searched
source: live probes of /.well-known/ on Benepass hosts
host: https://www.getbenepass.com
documents:
- path: /.well-known/security.txt
  status: 200
  file: benepass-security.txt
- path: /.well-known/openid-configuration
  status: 404
- path: /.well-known/oauth-authorization-server
  status: 404
- path: /.well-known/api-catalog
  status: 404
- path: /.well-known/ai-plugin.json
  status: 404
notes: >-
  Only /.well-known/security.txt is published (also served on the apex
  getbenepass.com). The app host app.getbenepass.com returns HTTP 200 for
  arbitrary /.well-known/* paths because it is a single-page-app catch-all
  (React shell), not a real discovery document, so those are not recorded.