Registry / auth-security / express-security-txt

express-security-txt

library4.0.1jsnpmunverified

Express middleware to serve a security.txt policy file at the standard /.well-known/security.txt or /security.txt endpoint. Current stable version 4.0.1. Released via semantic-release; adheres to the security.txt RFC draft (foudil-securitytxt-05). Key differentiators: supports repeating directives, inline comments (prefix, postfix, field-level), and array values for multiple contacts or policies. Lightweight—no external runtime dependencies; works with Express 4.x+. Safer alternatives exist (e.g., manual static file serving) if zero risk of misconfiguration is required.

auth-security web-framework

npm install express-security-txt

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-SECURITY-T

express-security-txt

auth-securityjavascriptv4.0.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

securityTxt

✓ import securityTxt from 'express-security-txt'

✗ const securityTxt = require('express-security-txt')

Package only ships ESM from v4; CJS require() will fail in Node (ERR_REQUIRE_ESM). Use dynamic import() in CommonJS contexts.

setup

✓ import { setup } from 'express-security-txt'

✗ import securityTxt, { setup } from 'express-security-txt'

setup is a named export; default export is also the setup function itself—both are identical.

SecurityTxtOptions

✓ import type { SecurityTxtOptions } from 'express-security-txt'

TypeScript users: import the type for options validation. No CJS type export available.

Sets up Express middleware to serve a security.txt policy at /.well-known/security.txt using the setup function with required contact and optional fields.

import express from 'express'; import securityTxt from 'express-security-txt'; const app = express(); const options = { contact: 'mailto:security@example.com', preferredLanguages: 'en', encryption: 'https://example.com/pgp-key.txt', acknowledgments: 'https://example.com/hall_of_fame', policy: 'https://example.com/policy', hiring: 'https://example.com/jobs' }; app.use(securityTxt.setup(options)); app.listen(3000, () => console.log('Server running on port 3000'));

Debug

Known issues

breakingVersion 4.0.0+ drops CommonJS support; package is ESM-only.

fix

Use dynamic import() or convert project to ESM. CJS projects should stay on v3.x (3.1.1).

affects: >=4.0.0

deprecatedThe 'securityTxt' default export is deprecated in favor of named 'setup' export as of v4.0.0.

fix

Use import { setup } from 'express-security-txt' instead of default import.

affects: >=4.0.0

gotchaOptions object keys are camelCase, not snake_case (e.g., 'preferredLanguages', not 'preferred_languages').

fix

Use camelCase keys as documented.

affects: all

gotchaThe package does not validate that at least one 'contact' field is provided; omitting it produces invalid security.txt per RFC.

fix

Always include a 'contact' option (string or array).

affects: all

breakingRemoved support for Node.js versions <18 in v4.0.0.

fix

Upgrade Node.js to >=18 or use v3.x.

affects: >=4.0.0

gotchaThe middleware does not automatically handle GET /security.txt (only /.well-known/security.txt). Users may need to add a redirect.

fix

Add a separate route for /security.txt that redirects to /.well-known/security.txt.

affects: all

Errors

Common errors & fixes

Error [ERR_REQUIRE_ESM]: require() of ES Module /path/to/node_modules/express-security-txt/index.js from /path/to/app.js not supported.

Version 4+ is ESM-only; CJS require() fails.

fix

Use dynamic import: const securityTxt = await import('express-security-txt'); or switch to ESM ("type": "module" in package.json).

SecurityTxtOptions is not a valid type. Did you mean SecurityTxtOptions?

TypeScript type name mismatch due to older version or incorrect import.

fix

Import type from v4: import type { SecurityTxtOptions } from 'express-security-txt';

TypeError: Cannot read properties of undefined (reading 'contact')

Options object passed is undefined or empty.

fix

Ensure options object is defined and contains at least 'contact' field: const options = { contact: '...' };

Cannot find module 'express-security-txt'

Package not installed or version mismatch.

fix

Run npm install express-security-txt@latest. Check package.json for version.

Upgrade

Version history

4.0.1latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

20 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/lirantal/express-security-txt ↗

packagehttps://www.npmjs.com/package/express-security-txt ↗