What does the Astro Security plugin do?
Astro Security generates a valid, RFC 9116–compliant security.txt file at build time for Astro sites using a strictly validated configuration file.
Astro & Security
Astro Security Plugin FAQs
Clear, production-focused answers explaining how Astro Security generates security.txt files, validates configuration, and fails safely.
Questions covered
Answers
Does Astro Security run at runtime?
No. Astro Security runs exclusively at build time and adds no runtime middleware, headers, or client-side logic.
Where is the configuration file stored?
From v1.0.0 onward, configuration lives at config-files/security.config.json.
Does Astro Security migrate older configurations?
Yes. Legacy v0.x configurations in the project root are automatically migrated once to the new location without overwriting existing files.
What happens if the configuration is invalid?
Astro Security fails closed. No security.txt file is generated, and the build continues safely.
Which fields are required by RFC 9116?
At minimum, Contact and Expires directives are required. Missing required fields prevent output generation.
Where can security.txt be written?
The plugin can write to /.well-known/security.txt, /security.txt, or both, depending on configuration.
Does Astro Security overwrite existing files?
Yes. Output files are overwritten deterministically on each build to guarantee consistency.
Does Astro Security collect analytics or telemetry?
No. Astro Security performs no analytics, tracking, telemetry, or outbound network requests.
Is Astro Security deterministic?
Yes. Given the same configuration, Astro Security always produces identical output.
Is Astro Security safe for CI/CD pipelines?
Yes. The plugin is designed to be deterministic, side-effect-free, and safe for automated build environments.
Is Astro Security open source?
Yes. Astro Security is fully open source and released under the MIT license.
Want to try it yourself? Astro Security plugin or Velohost security policy or security.txt specification
Ready to publish a compliant security.txt for your Astro site?