Flask-SecurityTxt

Flask-SecurityTxt Logo

Flask-SecurityTxt is a simple extension for Flask that makes it easy to add a security.txt file to your website. This file, as specified by the Internet Security Research Group, is used to provide information to security researchers about how to report vulnerabilities in your website.

The Flask-SecurityTxt logo makes use of the cloud-lock-outline icon created by Michael Richins as part of the Material Design Icons (MDI) library and published through Pictogrammers under the Apache License 2.0.

Installation

You can install Flask-SecurityTxt using pip:

pip install Flask-SecurityTxt

Usage

from flask import Flask
from flask_security_txt import SecurityTxt

app = Flask(__name__)
security_txt = SecurityTxt(app)

You can also customize the contents of the security.txt file by providing the following settings in the configuration file:

Property	Type	Default	Description
`SECURITY_TXT_ENDPOINT`	`str`	`"security_txt"`	The name by which the end-point will be known to the Flask-app.
`WELL_KNOWN_DIR`	`str`	`".well-known"`	The name of the directory that will contain the security.txt file.
`SECURITY_TXT_FILE_NAME`	`str`	`"security.txt"`	The name of the security.txt file.
`SECURITY_TXT_SIGN_KEY`	`str`	`None`	The path to a file containing a PGP key used for signing the security.txt file.
`SECURITY_TXT_CONTACT`	`str` `Iterable`	`None`	The value of the `Contact` field. An `Iterable` type value will result in multiple `Contact` fields. If `None`, the value is automatically generated from `SECURITY_TXT_CONTACT_MAILBOX`.
`SECURITY_TXT_CONTACT_MAILBOX`	`str`	`"security"`	The local part of the automatically generated `Contact` email address. Only used if `SECURITY_TXT_CONTACT` is `None`.
`SECURITY_TXT_EXPIRES`	`str` `datetime`	`None`	The value of the `Expires` field. A `str` type value is parsed into a `datetime` using `dateutil`; an unparseable string raises a `ValueError`. A `datetime` type value is formatted as an ISO 8601 timestamp with microseconds stripped. If `None`, the value is automatically generated using `SECURITY_TXT_EXPIRES_OFFSET`.
`SECURITY_TXT_EXPIRES_OFFSET`	`tuple` `timedelta`	`(0, 0, 0, 0, 0, 0, 1)`	The offset applied to `datetime.now()` to automatically generate the `Expires` field value. A `tuple` is unpacked and passed to the `timedelta` constructor, which interprets the values as days, seconds, microseconds, milliseconds, minutes, hours, and weeks.
`SECURITY_TXT_ENCRYPTION`	`str` `Iterable`	`None`	The value of the `Encryption` field. An `Iterable` type value will result in multiple `Encryption` fields. A value of `None` will omit the field entirely.
`SECURITY_TXT_ACKNOWLEDGEMENTS`	`str` `Iterable`	`None`	The value of the `Acknowledgments` field. An `Iterable` type value will result in multiple `Acknowledgments` fields. A value of `None` will omit the field entirely.
`SECURITY_TXT_PREFERRED_LANGUAGES`	`str` `Iterable`	`None`	The value of the `Preferred-Languages` field. An `Iterable` type value will result in a comma-separated string. If `None`, the value falls back to the translations listed by the `Flask-Babel` extension if it is loaded, or `"en"` otherwise.
`SECURITY_TXT_CANONICAL`	`str`	`None`	The value of the `Canonical` field. If `None`, the value is resolved from the endpoint name in `SECURITY_TXT_ENDPOINT` using `url_for`. A value of `None` with no resolvable endpoint will omit the field.
`SECURITY_TXT_POLICY`	`str` `Iterable`	`None`	The value of the `Policy` field. An `Iterable` type value will result in multiple `Policy` fields. A value of `None` will omit the field entirely.
`SECURITY_TXT_HIRING`	`str` `Iterable`	`None`	The value of the `Hiring` field. An `Iterable` type value will result in multiple `Hiring` fields. A value of `None` will omit the field entirely.
`SECURITY_TXT_FIELD_CASE`	`str`	`"standard"`	Controls the casing of field names in the output. Accepted values are `"standard"` (title case, e.g. `Contact:`), `"lower"` (e.g. `contact:`), and `"upper"` (e.g. `CONTACT:`).
`SECURITY_TXT_HEADER`	`str`	`None`	A comment block prepended to the security.txt. Set to `None` to omit the header entirely.
`SECURITY_TXT_FOOTER`	`str`		A comment block appended to the security.txt. The default footer includes the Flask-SecurityTxt version and project links. Set to `None` to omit the footer entirely.

Configuring Comments

For each field, a comment can be added on the line immediately preceding it by setting a config key of the form SECURITY_TXT_<FIELD>_COMMENT, where <FIELD> is the upper-case field name (e.g. SECURITY_TXT_CONTACT_COMMENT, SECURITY_TXT_EXPIRES_COMMENT). It is up to the developer to prepend each line of the comment with a # and add any desired whitespace.

Configuring Contact Details

The Contact field of the security.txt file can be configured with one of two different ways. First of all, the whole value string can be defined using the SECURITY_TXT_CONTACT property. This takes precedence over the alternative method, which uses the SECURITY_TXT_CONTACT_MAILBOX property. The value of this property is combined with the domain name of the current host, as it is known to Flask. The latter method is less reliable, as such the prior method is preferred if possible. By default, the contact is set to be "security@

Example

A security.txt file will be available in your website's .well-known directory, with the following contents:

Contact: mailto:security@example.com
Encryption: https://example.com/key.asc
Canonical: https://example.com/.well-known/security.txt

Contributing

Found a bug? Have a suggestion? Open an issue or submit a merge request at the Forgejo repository. All contributions are welcome.

Development Status
- 5 - Production/Stable
Environment
- Web Environment
Framework
- Flask
Intended Audience
- Developers

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

flask_securitytxt-1.3.10.tar.gz (22.5 kB view details)

Uploaded Aug 14, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

flask_securitytxt-1.3.10-py3-none-any.whl (19.6 kB view details)

Uploaded Aug 14, 2026 Python 3

File details

Details for the file flask_securitytxt-1.3.10.tar.gz.

File metadata

Download URL: flask_securitytxt-1.3.10.tar.gz
Upload date: Aug 14, 2026
Size: 22.5 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.13.5

File hashes

Hashes for flask_securitytxt-1.3.10.tar.gz
Algorithm	Hash digest
SHA256	`9485fb9890e662b8d5d09eb4eed34faf8a337123905875d28de78d8c945f6ace`
MD5	`563a1bb957c78818e42b4b5446eeb611`
BLAKE2b-256	`5284a683ef9d6fc79b553184092ba404233dd7d5f7acb21467c98ff05e47d763`

See more details on using hashes here.

File details

Details for the file flask_securitytxt-1.3.10-py3-none-any.whl.

File metadata

Download URL: flask_securitytxt-1.3.10-py3-none-any.whl
Upload date: Aug 14, 2026
Size: 19.6 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.13.5

File hashes

Hashes for flask_securitytxt-1.3.10-py3-none-any.whl
Algorithm	Hash digest
SHA256	`d7283e2b7e96d68fe310193495f95f8590e81f27a611900f69e9acc3ff80a0ab`
MD5	`70edbec8dbc9bd1aa1144fe477141547`
BLAKE2b-256	`d2075382cddebd765a7c9b1a0a2bcf9ad97e06fa72a22d58f8ecfd6165ae1604`