generated: '2026-07-24'
method: searched
notes: >-
  volt.io serves /.well-known/* via a redirect to the www host; only
  security.txt returns real RFC 9116 content. The other well-known paths
  (openid-configuration, oauth-authorization-server, api-catalog,
  ai-plugin.json) return the SPA HTML shell, not real documents. The API
  gateway host (gateway.volt.io) returns 404 for all /.well-known/ probes.
hosts:
- host: https://www.volt.io
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: volt-io-security.txt
    note: RFC 9116 - Contact security@volt.io + PGP encryption key
  - path: /.well-known/openid-configuration
    status: 200
    note: returns HTML shell (not a real OIDC discovery document)
  - path: /.well-known/oauth-authorization-server
    status: 200
    note: returns HTML shell (not a real RFC 8414 document)
  - path: /.well-known/api-catalog
    status: 200
    note: returns HTML shell (not a real RFC 9727 catalog)
  - path: /.well-known/ai-plugin.json
    status: 200
    note: returns HTML shell (not a real ai-plugin manifest)
- host: https://gateway.volt.io
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404