astro-securitytxt

An Astro integration that automatically generates an RFC 9116 compliant security.txt file during your site build.

Installation

npm install astro-securitytxt

Usage

Add the integration to your astro.config.mjs:

import { defineConfig } from "astro/config";
import securityTxt from "astro-securitytxt";

export default defineConfig({
  integrations: [
    securityTxt({
      contact: "mailto:[email protected]",
      expires: "2026-12-31T23:59:59.000Z",
    }),
  ],
});

After running astro build, the file will be placed at .well-known/security.txt in your build output by default.

Configuration

Required Fields

| Option | Type | Description | | --------- | -------------------- | ---------------------------------------------------------------------------------------------------- | | contact | string \| string[] | One or more contact URIs (e.g. mailto: or https:// links) for reporting security issues. | | expires | Date \| string | When the security.txt should be considered stale. ISO 8601 string or Date. Should be < 1 year out. |

Optional Fields

| Option | Type | Description | | -------------------- | ----------------------------------- | ---------------------------------------------------------------- | | encryption | string \| string[] | URI(s) to encryption key(s) for secure communication. | | acknowledgments | string \| string[] | URI(s) to pages recognizing security researchers. | | preferredLanguages | string | Comma-separated language tags (e.g. "en, es, de"). | | canonical | string \| string[] | Canonical URI(s) where the security.txt is hosted. | | policy | string \| string[] | URI(s) to vulnerability disclosure policy. | | hiring | string \| string[] | URI(s) to security-related job positions. | | placement | ".well-known" \| "root" \| "both" | Where to place the file. Defaults to ".well-known". See below. |

Placement

RFC 9116 Section 3 recommends placing the file at /.well-known/security.txt. Some sites also serve it at /security.txt for convenience.

| Value | Output path(s) | | --------------- | --------------------------------------------------- | | ".well-known" | /.well-known/security.txt (default) | | "root" | /security.txt | | "both" | /.well-known/security.txt and /security.txt |

Full Example

import { defineConfig } from "astro/config";
import securityTxt from "astro-securitytxt";

export default defineConfig({
  integrations: [
    securityTxt({
      contact: [
        "mailto:[email protected]",
        "https://example.com/security-contact",
      ],
      expires: new Date("2026-12-31T23:59:59Z"),
      encryption: "https://example.com/.well-known/pgp-key.txt",
      acknowledgments: "https://example.com/hall-of-fame",
      preferredLanguages: "en, de",
      canonical: "https://example.com/.well-known/security.txt",
      policy: "https://example.com/security-policy",
      hiring: "https://example.com/jobs",
      placement: "both",
    }),
  ],
});

This produces a security.txt like:

Contact: mailto:[email protected]
Contact: https://example.com/security-contact
Expires: 2026-12-31T23:59:59.000Z
Encryption: https://example.com/.well-known/pgp-key.txt
Acknowledgments: https://example.com/hall-of-fame
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy
Hiring: https://example.com/jobs

RFC 9116 Reference

• RFC 9116 — A File Format to Aid in Security Vulnerability Disclosure
• securitytxt.org

License

MIT