Weave Code
Securitytxt Bundle Laravel Package
koderhut/securitytxt-bundle
Symfony bundle for publishing an RFC 9116 security.txt file from your application. Configure your security contact, disclosure policy, expiry, and related fields, and the bundle exposes them at the standard well-known path so researchers can find your vulnerability reporting details.
A Symfony bundle to generate the security.txt document
Frequently asked questions about Securitytxt Bundle
- What is a security.txt file and why should I publish one?
- A security.txt file is a plain-text document defined by RFC 9116 that tells security researchers how to report a vulnerability in your application, plus when the information expires and where your disclosure policy lives. Scanners and researchers look for it at the well-known path /.well-known/security.txt. This bundle generates that file from your Symfony configuration instead of a hand-maintained static file, so your contact address and expiry date are versioned in Git and reviewed in pull requests like any other config change.
- How do I install koderhut/securitytxt-bundle with Composer?
- Install it with composer require koderhut/securitytxt-bundle. If you are not using Symfony Flex recipe auto-registration, enable the bundle in config/bundles.php. Then add your contact and expires values under the bundle's configuration key in config/packages and clear the cache. The bundle registers its own route and controller, so no additional wiring is required.
- Which fields can I configure in the security.txt?
- The bundle exposes the core RFC 9116 fields: contact, expires, encryption, and policy. Per the RFC, contact and expires are the mandatory ones, while encryption points to your PGP key and policy links to your vulnerability disclosure policy or security page. All of these are set in Symfony configuration rather than edited by hand in a public file.
- Where is the security.txt served from and can I change the path?
- The bundle serves the file at /.well-known/security.txt through a registered Symfony route, which is the location RFC 9116 and most security scanners expect. You generally should not move it, because tooling only checks the well-known path on each host. If you need to adjust or disable the route, review the bundle's routing configuration and make sure your web server still forwards /.well-known/ requests to Symfony rather than returning a 404 from the filesystem.
- Which Symfony and PHP versions does this bundle support?
- The supported version range is defined by the require constraints in the package's composer.json, which is the authoritative source. Check the package page on Packagist or run composer require and let Composer resolve against your installed Symfony version before assuming compatibility with Symfony 6 or 7. Because the bundle is a thin config-plus-route wrapper, constraint updates are usually straightforward, but always verify in a staging branch first.
- What format should the expires value use?
- RFC 9116 expects an RFC 3339 timestamp in UTC, for example 2025-12-31T23:59:59.000Z, and researchers may treat an expired or malformed value as a stale file. Keep the date comfortably in the future and renew it before it passes, ideally with a scheduled reminder or a calendar entry near the config file. Symfony's date configuration handling makes it easy to keep this value consistent with your release cycle.
- Can I use this package in a Laravel application?
- No, it is a Symfony bundle and depends on Symfony's dependency injection container, configuration tree, and routing, so it will not run inside a Laravel app. Laravel projects usually add a static public/.well-known/security.txt file or a one-line route returning the same plain-text payload. The field set is identical across both approaches, so you can copy the contact, expires, encryption, and policy values directly.
- How do I test that the security.txt endpoint works?
- Write a functional test with Symfony's WebTestCase and KernelBrowser, request /.well-known/security.txt, and assert a 200 status with a text/plain response. Then assert that the body contains your expected contact and expires lines so a broken configuration fails the build. Running this test in CI catches config typos or a missing bundle registration before deployment.
- Does serving security.txt through a route add overhead in production?
- The controller only reads configuration and returns a short plain-text response, with no database queries or external calls. Because the content changes rarely, it is a good candidate for Symfony's HTTP cache or your reverse proxy's cache layer, with a TTL shorter than the expires date. Do not cache it indefinitely, since an expired file misleads researchers more than a missing one.
- Is this bundle actively maintained and what happens if it is abandoned?
- Check the GitHub repository and Packagist release history for recent commits and version tags before committing to it in a long-lived project. Because the package is a small wrapper around a route and a config array, the fallback is low-risk: replace it with a static file or a few lines in a controller that returns the same four fields. Either way, keep the disclosure metadata under version control so a future migration is a copy-and-paste job.
Weaver
How can I help you explore Laravel packages today?