generated: '2026-08-26'
method: probed
source: Live unauthenticated GET of the /.well-known/ discovery surface on every host named in apis.yml
  (baseURL + Website) and in the Flo API Swagger `host` field, 2026-08-26.
description: 'Northmill serves one real .well-known document: an RFC 9116 security.txt on www.northmill.com,
  PGP-signed, carrying a Contact, a Policy and an Expires far in the future. Nothing else is served on
  either host. api.moreflo.com returns a real 404 (1,245-byte error body) for every /.well-known/ path,
  so this is a genuine absence rather than a catch-all 200.'
hit_count: 1
hosts:
- host: https://www.northmill.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: northmill-security.txt
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://api.moreflo.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://test.api.moreflo.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
security_txt:
  canonical: https://northmill.com/.well-known/security.txt
  contact: mailto:security@northmill.com
  encryption: https://northmill.com/.well-known/pgp-publickey.txt
  policy: https://northmill.com/se-en/about-us/security/
  preferred_languages: en
  hiring: https://careers.northmill.com
  expires: '2027-07-15T09:57:12Z'
  pgp_signed: true
notes:
- /llms.txt was probed on both hosts and returned 404 (www.northmill.com 404 HTML page, api.moreflo.com
  404). The llms.txt in llms/ is generated by API Evangelist, not published by Northmill.