"Expires" is mandatory in RFC9116 security.txt, but missing
https://gitlab.com/fdroid/fdroid-website/-/blob/master/.well-known/security.txt?ref_type=heads
has no Expires. You can check it online https://internet.nl/site/f-droid.org/2586160/#control-panel-31 or look it up in https://www.rfc-editor.org/rfc/rfc9116 there is a generator on https://securitytxt.org/