Do you run a paid bug bounty program? I saw an interesting presentation from Finn.no about how they got most of their vulnerabilities through that, basically none from their security.txt file, and a handful from people contacting the CISO on LinkedIn.