Weave Code
Securitytxt Laravel Package
koderhut/securitytxt
A Laravel package for publishing an RFC 9116 compliant security.txt file. Define contacts, expiry, encryption, and policy details in config, then let the package serve the file automatically so researchers always know how to report vulnerabilities.
A package to generate a security.txt file
Frequently asked questions about Securitytxt
- How do I install koderhut/securitytxt in a Laravel application?
- Install the package with Composer using composer require koderhut/securitytxt. Laravel package discovery should register the service provider automatically. Publish the package configuration if you need to customize contacts, expiry, encryption, or policy values, then set those values in config. Check the repository README for the exact publish command and any required setup steps.
- How do I configure contact details in security.txt?
- Define your contact entries in the package configuration file. RFC 9116 requires at least one Contact field, and values are typically mailto links or URLs where researchers can report vulnerabilities. The package uses those configured values when generating and serving the file.
- Does koderhut/securitytxt serve /.well-known/security.txt automatically?
- The package is designed to publish the security.txt file automatically so you do not need to write a custom controller. It should expose the standard /.well-known/security.txt location for security researchers. Verify route registration and any path-related configuration options in the README for your version.
- Which Laravel versions are supported by koderhut/securitytxt?
- The supported Laravel and PHP versions depend on the package release and its Composer constraints. Check the require section in composer.json and the compatibility notes in the repository README before installing. If you are on an older Laravel version, confirm support before adding it to production.
- How do I set the Expires field for security.txt?
- Configure the expiry value in the package configuration. RFC 9116 requires an Expires field with an ISO 8601 timestamp, and the package uses your configured value when generating the file. Choose a future date and update it before it passes so the file remains valid.
- Can I customize the security.txt path or disable automatic serving?
- The package is built around serving security.txt automatically from configuration. If you need a nonstandard path or want to disable the route, review the published config and README for available options before relying on it. For strict routing requirements, you may need to override or adapt the package behavior in your application.
- How can I test the generated security.txt locally?
- Run your Laravel application locally and request /.well-known/security.txt with curl or a browser. Check that the response contains the Contact, Expires, Encryption, and Policy fields you configured. You can also validate the output against RFC 9116 requirements before deploying.
- Is koderhut/securitytxt suitable for production use?
- It is intended for Laravel applications that need a consistently generated security.txt file. In production, ensure configuration caching is handled correctly and that the Expires date stays in the future. Avoid placing secrets in the configured fields because the file is publicly served.
- How is this package different from manually creating a security.txt file?
- A manual file must be maintained and placed in the correct location by hand. This package generates the file from Laravel configuration and serves it automatically, which helps keep contact, expiry, encryption, and policy details consistent. Manual files or other packages remain valid alternatives if you do not need config-driven generation.
- Does koderhut/securitytxt support Encryption and Policy fields?
- Yes, the package overview lists encryption and policy details as configurable values. Use Encryption to point researchers to your public key and Policy to link your vulnerability disclosure policy. The package includes those configured values when serving the RFC 9116 security.txt file.
Weaver
How can I help you explore Laravel packages today?