_posts/2025-06-05-vulnerability-reporting-process-overhaul.md
The Express.js project has completed a major milestone in its ongoing commitment to security: the implementation of a formal, centralized vulnerability reporting and response process.
Until recently, security reports were typically handled over email — an approach that worked in the early days but no longer scaled with the growing complexity and user base of Express. This informal system introduced potential delays, inconsistent handling, and increased the risk of issues being missed or misunderstood.
Thanks to support from the Sovereign Tech Fund, the Express.js Security Working Group has now completed a ground-up overhaul of how we manage vulnerability reports.
A comprehensive runbook and process flow have been created to guide maintainers through each step of triaging, confirming, and addressing reported security issues.
All Express.js repositories now share a single, unified SECURITY.md policy to ensure consistency and remove confusion for reporters and maintainers alike.
Security Advisories are now enabled across all Express.js repositories, allowing for secure, private vulnerability reporting through GitHub’s built-in system.
Expectations around ownership and response timelines have been clarified and published to reduce ambiguity and improve responsiveness.
A Security triage team member or the repo captain will acknowledge your report as soon as possible.
After the initial reply to your report, the security team will endeavor to keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.
As of June 2025, the OpenJS Foundation is officially a CVE Numbering Authority (CNA), empowered to assign CVE identifiers for security vulnerabilities across its hosted projects—including Express.
What this means for the community:
Please refer to Express’s Security Policy for the correct disclosure process. If needed, escalation routes through the OpenJS CNA are now available.
This advancement is part of a broader effort to strengthen the security of JavaScript’s open-source ecosystem—especially for widely used, community-driven projects like Express.
Learn more:
To further enhance the security of our ecosystem and encourage responsible vulnerability disclosure, the Express.js team has begun exploring participation in a community-focused bug bounty initiative—powered by the Sovereign Tech Resilience program.
This collaboration aims to:
Join the conversation and share your thoughts in expressjs/discussions#345 – Bug Bounty Proposal
Security is a shared responsibility — and one that must evolve as the project grows. With these updates, Express.js has laid the foundation for a more reliable, scalable, and transparent vulnerability response system.
We’re grateful to the OpenJS Foundation and the Sovereign Tech Fund for their support and are excited to share this progress with the broader community.