# TypeError/secure

Modern Python library for HTTP security headers with safe defaults, configurable presets, and first-class ASGI/WSGI middleware (FastAPI, Django, Flask, Shiny, and more).

Repository: https://github.com/TypeError/secure
Canonical: https://ross.abutalabs.com/products/typeerror-secure
Homepage: https://typeerror.com/secure/
Language: Python
License: MIT
License Family: permissive
Topics: fastapi, flask, django, content-security-policy, http-headers, python, security, security-headers, strict-transport-security, web-security, shiny, asgi, wsgi
Last push: 2026-07-23T00:33:38+00:00

## Health v2 (maintenance only)
Score: 79/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 93, release rhythm 48, longevity 100
- inputs: {"age_days": 2837, "days_push": 42, "days_rel": 133, "gap_med": 286.0, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1049, forks 33 (observed 2026-08-28T04:03:22.580091+00:00)

## What it is
A lightweight, dependency-free Python library for defining and applying HTTP security headers across Python web frameworks via ASGI/WSGI middleware or response hooks. It offers safe default presets, builders for complex headers like Content-Security-Policy, and integrations for FastAPI, Django, Flask, and Shiny.

## Use cases
- add security headers to a FastAPI app
- set Content-Security-Policy in Django
- apply HSTS headers across a Flask application
- centralize security header configuration instead of copy-pasting header strings
- add security headers via ASGI or WSGI middleware
- configure Permissions-Policy and Cross-Origin headers in Python web apps

## When to choose
- you want one reusable security-header policy across multiple Python frameworks
- you prefer safe defaults with presets you can customize
- you need CSP or Permissions-Policy builders rather than hand-written header strings

## When to avoid
- you need a full web application firewall or request-level attack detection
- headers are already managed centrally by your reverse proxy or CDN
- you need security tooling beyond HTTP response headers

## Facets
- artifact type: library
- maturity: active
- function: security, middleware, http-server
- domain: security, web-development, backend
- platform: python
- tags: security-headers, content-security-policy, asgi, wsgi, fastapi, django, flask, strict-transport-security, http-headers, web-server

## Member repositories
- TypeError/secure (main) score 79

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:22.580091+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:00:27.713521+00:00, confidence not recorded.
  - readme: https://github.com/TypeError/secure (fetched 2026-08-28T04:03:22.580091+00:00, sha 33ae88be81d9)
  - homepage: https://typeerror.com/secure/ (fetched 2026-08-29T13:02:06.760789+00:00, sha 8981d6176506)
  - registry_pypi: https://pypi.org/pypi/secure/json (fetched 2026-08-29T13:02:06.772728+00:00, sha 4458cfa53f55)
  - site_page: https://typeerror.com/secure/changelog.html (fetched 2026-08-29T13:02:06.770251+00:00, sha d1d1400eaddd)
- Data as of 2026-08-30T08:39:29.467469+00:00.