Hmm wondering how common some of these are ... I'd love /.well-known/change-password but it looks like https://news.ycombinator.com/.well-known/change-password and google.com/.well-known/change-password don't seem to be implemented?
It works in Safari and Chrome it looks like: https://web.dev/articles/change-password-url
I've never heard of it actually being used, though.
Google's URL is on https://accounts.google.com/.well-known/change-password but not on their main domain.
security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail