Contact and Expires are required by RFC 9116.
About security.txt
RFC 9116 defines a standard location (/.well-known/security.txt) where security researchers can find instructions for reporting vulnerabilities. The Contact field tells researchers where to send reports (email, web form, or bug bounty platform). Expires prevents stale files from misleading researchers after the contact changes. Adding a PGP encryption key URL lets researchers send encrypted reports. Once published, coordinate disclosure becomes much easier and you reduce the risk of vulnerabilities being disclosed publicly without your knowledge.