---
title: How Express.js Rebuilt Its Vulnerability Reporting Process
description: Express.js has overhauled its vulnerability reporting workflow with a unified process, consolidated documentation, and GitHub Security Advisories enabled across all repositories.
tags: security vulnerabilities process governance
authors:
  - name: Ulises Gascón
    github: UlisesGascon
---


The Express.js project has completed a major milestone in its ongoing commitment to security: the implementation of a formal, centralized vulnerability reporting and response process.

Until recently, security reports were typically handled over email — an approach that worked in the early days but no longer scaled with the growing complexity and user base of Express. This informal system introduced potential delays, inconsistent handling, and increased the risk of issues being missed or misunderstood.

Thanks to support from the [Sovereign Tech Fund](https://sovereign.tech), the Express.js Security Working Group has now completed a ground-up overhaul of how we manage vulnerability reports.


## 🛠️ Key Improvements

### Formalized Vulnerability Reporting Workflow

A comprehensive runbook and process flow have been created to guide maintainers through each step of triaging, confirming, and addressing reported security issues.  
- [View the documentation](https://github.com/expressjs/security-wg/blob/main/docs/incident_response_plan.md)  
- [Security Report Handling Flowchart](https://github.com/expressjs/security-wg/blob/main/docs/incident_response_plan.md#security-report-handling-flowchart)

### Unified Security Policy Across Repositories

All Express.js repositories now share a single, unified `SECURITY.md` policy to ensure consistency and remove confusion for reporters and maintainers alike.  

- [View the unified Security Policy](https://github.com/expressjs/.github/blob/master/SECURITY.md)

### GitHub Security Advisories Enabled

Security Advisories are now enabled across all Express.js repositories, allowing for secure, private vulnerability reporting through GitHub’s built-in system.

- [How to report a security bug using GitHub Security Advisory](https://github.com/expressjs/.github/blob/master/SECURITY.md#reporting-security-bugs-via-github-security-advisory-preferred)

### Clear Maintainer Responsibilities

Expectations around ownership and response timelines have been clarified and published to reduce ambiguity and improve responsiveness.  

> A [Security triage team member](https://github.com/expressjs/security-wg#security-triage-team) or [the repo captain](https://github.com/expressjs/discussions/blob/master/docs/contributing/captains_and_committers.md) will acknowledge your report as soon as possible.
>
> After the initial reply to your report, the security team will
endeavor to keep you informed of the progress towards a fix and full
announcement, and may ask for additional information or guidance.
>
> _[Security Policy](https://github.com/expressjs/.github/blob/master/SECURITY.md)_


## 🛡️ Express is Now Covered Under the OpenJS Foundation CNA

As of June 2025, the [OpenJS Foundation](https://openjsf.org/) is officially a [CVE Numbering Authority (CNA)](https://openjsf.org/blog/openjs-foundation-cna), empowered to assign CVE identifiers for security vulnerabilities across its hosted projects—including Express.

What this means for the community:

- Security vulnerabilities in Express can now receive official CVE IDs through OpenJS, improving transparency and coordination.
- The foundation provides support and tooling to streamline the vulnerability disclosure process, particularly for maintainers and security researchers.
- For critical issues, the CNA helps ensure that disclosures follow best practices and are recorded in global vulnerability databases.


Please refer to [Express’s Security Policy](https://github.com/expressjs/express/security/policy) for the correct disclosure process. If needed, escalation routes through the OpenJS CNA are now available.

This advancement is part of a broader effort to strengthen the security of JavaScript’s open-source ecosystem—especially for widely used, community-driven projects like Express.

Learn more:
- [OpenJS Foundation is now a CNA – Official Blog Post](https://openjsf.org/blog/openjs-foundation-cna)
- [Socket.dev Coverage: OpenJS Foundation Becomes a CNA](https://socket.dev/blog/openjs-foundation-is-now-a-cna)

## 👀 Coming Soon: Bug Bounty Program in the Works

To further enhance the security of our ecosystem and encourage responsible vulnerability disclosure, the Express.js team has begun exploring participation in a community-focused bug bounty initiative—powered by the [Sovereign Tech Resilience program](https://www.sovereign.tech/programs/bug-resilience).

This collaboration aims to:

- Reward contributors for discovering and responsibly reporting security issues
- Improve our ability to address vulnerabilities quickly and transparently
- Strengthen long-term resilience for users and maintainers alike

Join the conversation and share your thoughts in [expressjs/discussions#345 – Bug Bounty Proposal](https://github.com/expressjs/discussions/issues/345)

## Why This Matters

Security is a shared responsibility — and one that must evolve as the project grows. With these updates, Express.js has laid the foundation for a more reliable, scalable, and transparent vulnerability response system.

We’re grateful to the [OpenJS Foundation](https://openjsf.org/) and the [Sovereign Tech Fund](https://www.sovereign.tech/) for their support and are excited to share this progress with the broader community.
