The Express.js Security Working Group is a governance body that manages security processes and policies for the Express project and its ecosystem packages.
The working group addresses the need for coordinated vulnerability management and security improvement across Express and related packages. It operates through two structures: a Security Triage Team that handles incoming security reports, prepares patches, and coordinates disclosures in a controlled manner; and regular members who manage public-facing security activities. The group defines security policies, maintains procedures for handling reports, and provides guidance to the ecosystem on building secure middleware.
This is not a tool for developers to adopt in their own projects, but rather a governance structure within the Express ecosystem. Developers using Express should be aware that security vulnerabilities are managed through this working group's triage process. The group maintains a defined scope of packages covered by its security policies, documented separately. Organizations relying on Express for production systems benefit from the existence of this coordinated security management, though interaction with it typically occurs only when reporting vulnerabilities or when security updates are released.
The working group has completed foundational initiatives including an OpenSSF Scorecard assessment and a threat model for the Express project. The group maintains active engagement with broader open source security initiatives through the OpenJS Foundation and the OpenSSF Best Practices working group, indicating participation in ecosystem-wide security improvement efforts.
