Hmm wondering how common some of these are ... I'd love /.well-known/change-password but it looks like https://news.ycombinator.com/.well-known/change-password and google.com/.well-known/change-password don't seem to be implemented?
security.txt is always under this folder for sites if it exists, it's also used by letsencrypt for certs or renewals fail
It works in Safari and Chrome it looks like: https://web.dev/articles/change-password-url
I've never heard of it actually being used, though.
Google's URL is on https://accounts.google.com/.well-known/change-password but not on their main domain.