Can the file be publicly accessible but only with a specific key appended to the URL. For example? /.well-known/apple-app-site-association/key=Abc123 Bot/hacker traffic to everyone's server directed at this specific file is surging. Exposed to bots/hackers , they now know "Okay. Let me just download any one of your apps, Jail break in with any ***** or any other one, change the info plist to point to any domain, and proceed to attempt password reset requests. It's safer not to use this file.