Facebook have the security.txt at root: https://facebook.com/security.txt

Both Facebook and Apple also use [URL]/.well-known/security.txt

The contact on Facebook don't work: https://www.facebook.com/whitehat/report/