From dd5e23f7be5ffc211a406880e2a4fce6c8cb5d77 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Mon, 8 Sep 2025 12:32:32 +0200 Subject: [PATCH 1/2] docs: mention the Express Threat Model Added a section on the Express Threat Model to the security policy. Related: https://github.com/expressjs/express/pull/6570#pullrequestreview-2947482592 --- SECURITY.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 38b4775..e5a2c48 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,6 +6,7 @@ project. * [Reporting a Bug or Security Vulnerability](#reporting-a-bug-or-security-vulnerability) * [Disclosure Policy](#disclosure-policy) * [Comments on this Policy](#comments-on-this-policy) + * [The Express Threat Model](#the-express-threat-model) ## Reporting a Bug or Security Vulnerability @@ -71,3 +72,7 @@ involving the following steps: If you have suggestions on how this process could be improved please submit a pull request. + +## The Express Threat Model + +The most updated version can be found [here](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md) From 742d44936b7042ca6ac928f7672979c72cf09b86 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Mon, 5 Jan 2026 17:18:56 -0500 Subject: [PATCH 2/2] expand on threat model, add !IMPORTANT in reporting section --- SECURITY.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index e5a2c48..3bdcdca 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,6 +10,9 @@ project. ## Reporting a Bug or Security Vulnerability +> [!IMPORTANT] +> Before reporting a vulnerability, please review the [Express Threat Model](#the-express-threat-model) to check if the issue falls within Express's security scope. + The Express team and community take all security vulnerabilities seriously. Thank you for improving the security of Express and related projects. We appreciate your efforts in responsible disclosure and will make every effort @@ -75,4 +78,8 @@ pull request. ## The Express Threat Model -The most updated version can be found [here](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md) +The Express threat model defines the boundaries of what the framework considers its security responsibility. It establishes which elements are trusted (such as the developer, the runtime environment, and application code) versus untrusted (such as data from network connections). Issues arising from trusted elements are considered out of scope, while Express is responsible for safely handling untrusted data. + +Many commonly reported concerns fall outside Express's security scope and are the responsibility of the application developer. Such as prototype pollution from unsanitized user input, misconfigured static file serving, or issues in third-party dependencies. + +For complete details, see the [Express Threat Model](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md).