Dependency scanning

The SDK can report your application's installed Composer packages so the Quiet Guard server can scan them against known security advisories and alert you when a vulnerability affects a version you run.

The command

php artisan monitor:dependencies

This reads your composer.lock, builds a snapshot of every installed package and posts it to the server's /api/v1/dependencies endpoint. The server stores the snapshot and queues a scan against Packagist security advisories.

When MONITOR_ENABLED=false, the command prints a notice and sends nothing.

Options

php artisan monitor:dependencies --path=/var/www/releases/current/composer.lock

What gets sent

The command parses both packages and packages-dev from composer.lock. For each entry it sends:

• name: the package name (e.g. laravel/framework);
• version: the locked version, with any leading v stripped (e.g. 12.3.1);
• is_dev: whether it came from packages-dev.

Only the lock file is read. No source code, no .env, and no composer.json constraints are sent, just the resolved name/version pairs already public on Packagist.

Scheduling it

Run the command on every deploy so the snapshot always matches what is in production, and optionally on a daily schedule so newly published advisories are picked up against your current lockfile.

Add it to your application's scheduler in routes/console.php:

use Illuminate\Support\Facades\Schedule;

Schedule::command('monitor:dependencies')->dailyAt('06:00');

Or as part of your deploy script, right after composer install:

php artisan monitor:dependencies

Exit codes

• Success when the dependencies are reported, when the SDK is disabled, or when no packages are found.
• Failure when composer.lock cannot be found at the given path, or when the upload fails (check MONITOR_URL / MONITOR_KEY).

Where results appear

Findings show up on your project's Vulnerabilities tab in the Quiet Guard dashboard, and new vulnerabilities trigger alerts through your configured notification channels. See the server documentation for managing and ignoring findings.