Astro Integration
Astro Security
Generate a valid, RFC 9116–compliant security.txt file for Astro sites deterministically at build time.
Usage snapshot
Why this plugin exists
security.txt provides a standardised way for security researchers to report vulnerabilities, but it is often missing, outdated, or incorrectly implemented.
Astro Security generates a fully RFC 9116–compliant security.txt file at build time, ensuring correctness without introducing runtime middleware or headers.
Configuration is validated and normalised strictly. If requirements are not met, the plugin fails closed and produces no output.
What it delivers
Design principles
- Build-time only — zero runtime middleware or headers
- Fail-closed validation — no output if config is invalid
- Deterministic output on every build
- Static-first and CI/CD safe
- No analytics, telemetry, or outbound requests
What this plugin does
- Generates an RFC 9116–compliant security.txt file
- Validates and normalises configuration strictly
- Automatically migrates legacy v0.x configs to v1.x
- Overwrites output deterministically on each build
- Supports both /.well-known and root output paths
Installation
npm install astro-security
From v1.0.0 onward, configuration is stored in config-files/security.config.json with automatic migration from legacy locations.
Project links
Source code, releases, documentation, and contribution guidelines.
Want the deep dive?
Read the FAQs for implementation details, design rationale, and integration guidance.
View plugin FAQs