express-security-txt

Express middleware to serve a security.txt policy file at the standard /.well-known/security.txt or /security.txt endpoint. Current stable version 4.0.1. Released via semantic-release; adheres to the security.txt RFC draft (foudil-securitytxt-05). Key differentiators: supports repeating directives, inline comments (prefix, postfix, field-level), and array values for multiple contacts or policies. Lightweight—no external runtime dependencies; works with Express 4.x+. Safer alternatives exist (e.g., manual static file serving) if zero risk of misconfiguration is required.