Flask-SecurityTxt

Flask-SecurityTxt is a simple extension for Flask that makes it easy to add a security.txt file to your website. This file, as specified by RFC 9116 and described at securitytxt.org, is used to provide information to security researchers about how to report vulnerabilities in your website.

The Flask-SecurityTxt logo makes use of the cloud-lock-outline icon created by Michael Richins as part of the Material Design Icons (MDI) library and published through Pictogrammers under the Apache License 2.0.

Installation

You can install Flask-SecurityTxt using pip:

pip install Flask-SecurityTxt

Signing the security.txt with a PGP key requires pgpy, which is not installed by default:

pip install Flask-SecurityTxt[sign]

If Flask-Babel is used to detect the value of the Preferred-Languages field, it can be installed through the babel extra in the same way:

pip install Flask-SecurityTxt[babel]

Usage

from flask import Flask
from flask_security_txt import SecurityTxt

app = Flask(__name__)
security_txt = SecurityTxt(app)

Under the application factory pattern, the application is passed to init_app() instead. A single SecurityTxt instance can initialize several applications, each with its own configuration:

security_txt = SecurityTxt()

def create_app():
    app = Flask(__name__)
    security_txt.init_app(app)
    return app

You can also customize the contents of the security.txt file by providing the following settings in the configuration file:

Every field that holds a URL accepts, besides a full URL using one of the schemes allowed for that field, the name of a file in the application's static folder or the name of an end-point that can be resolved by the application. Both are rendered as external https: URLs. A value that is none of the three raises a ValueError.

These settings can also be passed to the constructor, as a dict whose keys are the property names without the SECURITY_TXT_ prefix and in lower case. They then serve as defaults, which the application configuration still overrides. An unknown key raises a ValueError, so that a typo is not silently ignored:

security_txt = SecurityTxt(app, config={
    "contact_mailbox": "abuse",
    "expires_offset": {"days": 90},
})

Configuring Comments

For each field, a comment can be added on the line immediately preceding it by setting a config key of the form SECURITY_TXT_<FIELD>_COMMENT, where <FIELD> is the upper-case field name with any hyphen replaced by an underscore (e.g. SECURITY_TXT_CONTACT_COMMENT, SECURITY_TXT_PREFERRED_LANGUAGES_COMMENT). Each line of the comment is prefixed with SECURITY_TXT_COMMENT_LINE_PREFIX automatically, and the comment is preceded by an empty line. The comment of which a field is not rendered, is not rendered either.

Configuring Contact Details

The Contact field of the security.txt file can be configured with one of two different ways. First of all, the whole value string can be defined using the SECURITY_TXT_CONTACT property. This takes precedence over the alternative method, which uses the SECURITY_TXT_CONTACT_MAILBOX property. The value of this property is combined with the domain name in SERVER_NAME, or with that of the current request if SERVER_NAME is not configured. The latter method is less reliable, as the client determines the host of a request; as such, the prior method is preferred if possible. By default, the contact is set to be "security@<domain>", with the domain name being provided by Flask.

Example

A security.txt file will be available in your website's .well-known directory, with the following contents:

#
# GENERATED BY FLASK-SECURITYTXT 1.4.0
#
# Flask-SecurityTxt has been developed by M.P. van de Weerd for
# Parcifal Programmatics under the AGPLv3 licence.
#
# https://pypi.org/project/Flask-SecurityTxt/
# https://scm.parcifal.dev/parcifal/flask-security-txt
#
# https://www.van-de-weerd.net/
# https://www.parcifal.dev/
#
Contact: mailto:security@example.com
Expires: 2026-10-12T13:52:49+00:00
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

Contributing

Found a bug? Have a suggestion? Open an issue or submit a merge request at the Forgejo repository. All contributions are welcome.