{"id":15188443,"url":"https://github.com/austinheap/laravel-security-txt","last_synced_at":"2025-10-02T03:30:48.416Z","repository":{"id":62489620,"uuid":"106077909","full_name":"austinheap/laravel-security-txt","owner":"austinheap","description":"A package for serving `security.txt` in Laravel 5.5+, based on configuration settings. https://securitytext.org/","archived":true,"fork":false,"pushed_at":"2019-03-21T22:03:49.000Z","size":920,"stargazers_count":10,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-12-16T23:23:37.504Z","etag":null,"topics":["composer","composer-package","laravel","laravel-5-package","laravel5","laravel55","php","php7","php70","php71","php72","security","security-txt"],"latest_commit_sha":null,"homepage":"https://packagist.org/packages/austinheap/laravel-security-txt","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/austinheap.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-10-07T06:59:42.000Z","updated_at":"2023-01-28T09:42:51.000Z","dependencies_parsed_at":"2022-11-02T11:16:05.113Z","dependency_job_id":null,"html_url":"https://github.com/austinheap/laravel-security-txt","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/austinheap%2Flaravel-security-txt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/austinheap%2Flaravel-security-txt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/austinheap%2Flaravel-security-txt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/austinheap%2Flaravel-security-txt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/austinheap","download_url":"https://codeload.github.com/austinheap/laravel-security-txt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234929344,"owners_count":18908925,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["composer","composer-package","laravel","laravel-5-package","laravel5","laravel55","php","php7","php70","php71","php72","security","security-txt"],"created_at":"2024-09-27T19:20:22.228Z","updated_at":"2025-10-02T03:30:43.026Z","avatar_url":"https://github.com/austinheap.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Laravel 5.5+ `security.txt` Package\n\n![laravel-security-txt banner from the documentation](docs/img/banner-1544x500.png?raw=true)\n\n[![License](https://img.shields.io/packagist/l/austinheap/laravel-security-txt.svg)](https://github.com/austinheap/laravel-security-txt/blob/master/LICENSE.md)\n[![Current Release](https://img.shields.io/github/release/austinheap/laravel-security-txt.svg)](https://github.com/austinheap/laravel-security-txt/releases)\n[![Total Downloads](https://img.shields.io/packagist/dt/austinheap/laravel-security-txt.svg)](https://packagist.org/packages/austinheap/laravel-security-txt)\n[![Build Status](https://travis-ci.org/austinheap/laravel-security-txt.svg?branch=master)](https://travis-ci.org/austinheap/laravel-security-txt)\n[![Dependency Status](https://gemnasium.com/badges/github.com/austinheap/laravel-security-txt.svg)](https://gemnasium.com/github.com/austinheap/laravel-security-txt)\n[![Scrutinizer CI](https://scrutinizer-ci.com/g/austinheap/laravel-security-txt/badges/quality-score.png?b=master)](https://scrutinizer-ci.com/g/austinheap/laravel-security-txt/)\n[![StyleCI](https://styleci.io/repos/106077909/shield?branch=master)](https://styleci.io/repos/106077909)\n[![Maintainability](https://api.codeclimate.com/v1/badges/ca1e10510f778f520bb5/maintainability)](https://codeclimate.com/github/austinheap/laravel-security-txt/maintainability)\n[![Test Coverage](https://api.codeclimate.com/v1/badges/ca1e10510f778f520bb5/test_coverage)](https://codeclimate.com/github/austinheap/laravel-security-txt/test_coverage)\n[![SensioLabs](https://insight.sensiolabs.com/projects/9fe66b91-58ad-4bc3-9ec9-37b396bb4837/mini.png)](https://insight.sensiolabs.com/projects/9fe66b91-58ad-4bc3-9ec9-37b396bb4837)\n\n## A package for serving `security.txt` in Laravel 5.5+, based on configuration settings.\n\nThe purpose of this project is to create a set-it-and-forget-it package that can be\ninstalled without much effort to get a Laravel project compliant with the current\n[`security.txt`](https://securitytxt.org/) spec. It is therefore highly opinionated\nbut built for configuration.\n\nWhen enabled, it allows access to all clients and serves up the `security.txt`.\nOtherwise, it operates almost identically to Laravel's default configuration,\ndenying access to all clients.\n\n[`security.txt`](https://github.com/securitytxt) is a [draft](https://tools.ietf.org/html/draft-foudil-securitytxt-00)\n\"standard\" which allows websites to define security policies. This \"standard\"\nsets clear guidelines for security researchers on how to report security issues,\nand allows bug bounty programs to define a scope. Security.txt is the equivalent\nof `robots.txt`, but for security issues.\n\nThere is [documentation for `laravel-security-txt` online](https://austinheap.github.io/laravel-security-txt/),\nthe source of which is in the [`docs/`](https://github.com/austinheap/laravel-security-txt/tree/master/docs)\ndirectory. The most logical place to start are the [docs for the `SecurityTxt` class](https://austinheap.github.io/laravel-security-txt/classes/AustinHeap.Security.Txt.SecurityTxt.html).\n\n## Table of Contents\n\n* [Summary](#a-package-for-serving-securitytxt-in-laravel-55-based-on-configuration-settings)\n* [Installation](#installation)\n    + [Step 1: Composer](#step-1-composer)\n    + [Step 2: Remove any existing `security.txt`](#step-2-remove-any-existing-securitytxt)\n    + [Step 3: Enable the package (Optional)](#step-3-enable-the-package-optional)\n    + [Step 4: Configure the package](#step-4-configure-the-package)\n* [Full `.env` Example](#full-env-example)\n* [Unit Tests](#unit-tests)\n* [References](#references)\n* [Credits](#credits)\n* [License](#license)\n\n## Installation\n\n### Step 1: Composer\n\nVia Composer command line:\n\n```bash\n$ composer require austinheap/laravel-security-txt\n```\n\nOr add the package to your `composer.json`:\n\n```json\n{\n    \"require\": {\n        \"austinheap/laravel-security-txt\": \"0.3.*\"\n    }\n}\n```\n\n### Step 2: Remove any existing `security.txt`\n\nLaravel doesn't ship with a default `security.txt` file. If you have added one, it needs to be removed for the configured route to work.\n\n```bash\n$ rm public/.well-known/security.txt\n```\n\n### Step 3: Enable the package (Optional)\n\nThis package implements Laravel 5.5's auto-discovery feature. After you install it the package provider and facade are added automatically.\n\nIf you would like to declare the provider and/or alias explicitly, then add the service provider to your `config/app.php`:\n\nAdd the service provider to your `config/app.php`:\n\n```php\n'providers' =\u003e [\n    //\n    AustinHeap\\Security\\Txt\\SecurityTxtServiceProvider::class,\n];\n```\n\nAnd then add the alias to your `config/app.php`:\n\n```php\n'aliases' =\u003e [\n    //\n    'SecurityTxt' =\u003e AustinHeap\\Security\\Txt\\SecurityTxtFacade::class,\n];\n```\n\n### Step 4: Configure the package\n\nPublish the package config file:\n\n```bash\n$ php artisan vendor:publish --provider=\"AustinHeap\\Security\\Txt\\SecurityTxtServiceProvider\"\n```\n\nYou may now allow clients via `security.txt` by editing the `config/security-txt.php` file, opening up the route to the public:\n\n```php\nreturn [\n    'enabled' =\u003e env('SECURITY_TXT_ENABLED', true),\n];\n```\n\nOr simply setting the the `SECURITY_TXT_ENABLED` environment variable to true, via the Laravel `.env` file or hosting environment.\n\n```bash\nSECURITY_TXT_ENABLED=true\n```\n\n## Full `.env` Example\n\nAfter installing the package with composer, simply add the following to your .env file:\n\n```bash\nSECURITY_TXT_ENABLED=true\nSECURITY_TXT_CACHE=true\nSECURITY_TXT_CONTACT=security@your-site.com\nSECURITY_TXT_ENCRYPTION=https://your-site.com/pgp.key\nSECURITY_TXT_DISCLOSURE=full\nSECURITY_TXT_ACKNOWLEDGEMENT=https://your-site.com/security-champions\n```\n\nNow point your browser to `http://your-site.com/.well-known/security.txt` and you should see:\n\n```\n# Our security address\nContact: me@austinheap.com\n\n# Our PGP key\nEncryption: http://some.url/pgp.key\n\n# Our disclosure policy\nDisclosure: Full\n\n# Our public acknowledgement\nAcknowledgement: http://some.url/acks\n\n#\n# Generated by \"laravel-security-txt\" v0.4.0 (https://github.com/austinheap/laravel-security-txt/releases/tag/v0.4.0)\n# using \"php-security-txt\" v0.4.0 (https://github.com/austinheap/php-security-txt/releases/tag/v0.4.0)\n# in 0.041008 seconds on 2017-11-22 20:31:25.\n#\n# Cache is enabled with key \"cache:AustinHeap\\Security\\Txt\\SecurityTxt\".\n#\n```\n\n## Unit Tests\n\nThis package has aggressive unit tests built with the wonderful [orchestral/testbench](https://github.com/orchestral/testbench)\npackage which is built on top of PHPUnit.\n\nThere are [code coverage reports for `laravel-security-txt`](https://austinheap.github.io/laravel-security-txt/coverage/)\navailable online.\n\n## References\n\n- [A Method for Web Security Policies (draft-foudil-securitytxt-00)](https://tools.ietf.org/html/draft-foudil-securitytxt-00)\n- [php-security-txt](https://github.com/austinheap/php-security-txt)\n- [securitytext.org](https://securitytext.org/)\n\n## Credits\n\nThis is a fork of [InfusionWeb/laravel-robots-route](https://github.com/InfusionWeb/laravel-robots-route),\nwhich was a fork of [ellisthedev/laravel-5-robots](https://github.com/ellisthedev/laravel-5-robots),\nwhich was a fork of [jayhealey/Robots](https://github.com/jayhealey/Robots),\nwhich was based on earlier work.\n\n- [ellisio/laravel-5-robots Contributors](https://github.com/ellisio/laravel-5-robots/graphs/contributors)\n- [InfusionWeb/laravel-robots-route Contributors](https://github.com/InfusionWeb/laravel-robots-route/contributors)\n\n## License\n\nThe MIT License (MIT). Please see [License File](LICENSE.md) for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faustinheap%2Flaravel-security-txt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faustinheap%2Flaravel-security-txt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faustinheap%2Flaravel-security-txt/lists"}