Skip to content

docs: mention the Express Threat Model#36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonchurch merged 2 commits into from
Jan 5, 2026
Merged

docs: mention the Express Threat Model #36

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd5e23f
docs: mention the Express Threat Model
UlisesGascon Sep 8, 2025
742d449
expand on threat model, add !IMPORTANT in reporting section
jonchurch Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,9 +6,13 @@ project.
* [Reporting a Bug or Security Vulnerability](#reporting-a-bug-or-security-vulnerability)
* [Disclosure Policy](#disclosure-policy)
* [Comments on this Policy](#comments-on-this-policy)
* [The Express Threat Model](#the-express-threat-model)

## Reporting a Bug or Security Vulnerability

> [!IMPORTANT]
> Before reporting a vulnerability, please review the [Express Threat Model](#the-express-threat-model) to check if the issue falls within Express's security scope.

The Express team and community take all security vulnerabilities seriously.
Thank you for improving the security of Express and related projects.
We appreciate your efforts in responsible disclosure and will make every effort
Expand DownExpand Up@@ -71,3 +75,11 @@ involving the following steps:

If you have suggestions on how this process could be improved please submit a
pull request.

## The Express Threat Model

The Express threat model defines the boundaries of what the framework considers its security responsibility. It establishes which elements are trusted (such as the developer, the runtime environment, and application code) versus untrusted (such as data from network connections). Issues arising from trusted elements are considered out of scope, while Express is responsible for safely handling untrusted data.

Many commonly reported concerns fall outside Express's security scope and are the responsibility of the application developer. Such as prototype pollution from unsanitized user input, misconfigured static file serving, or issues in third-party dependencies.

For complete details, see the [Express Threat Model](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md).