Dependency security

Quiet Guard watches the third-party packages your app depends on and raises a finding the moment one of them has a known security advisory. You reach it from a project's Vulnerabilities tab in the /app panel.

Available on every plan, including Free, dependency scanning is part of the vulnerability_scan feature shipped by default.

composer.lock snapshots

Your client reports the project's installed packages by posting the parsed composer.lock to /api/v1/dependencies:

{
  "packages": [
    { "name": "laravel/framework", "version": "11.9.0", "is_dev": false },
    { "name": "phpunit/phpunit", "version": "11.2.0", "is_dev": true }
  ]
}

Each package carries a name, a resolved version, and an is_dev flag. The server stores this as the project's current dependency snapshot, replacing the previous one. The reference Laravel client ships a monitor:dependencies command for this.

Packagist advisory matching

After each snapshot is stored, a background scan runs:

1. It queries the Packagist security advisories database for your packages.
2. It matches each advisory's affected version constraints against your installed version using composer/semver.
3. Matching advisories become vulnerability findings on the project.

Fails loudly, never silently. If the advisory fetch errors, the scan aborts rather than treating "no data" as "no vulnerabilities". A network blip must never mass-resolve your findings.

Findings, auto-resolve and ignore

Each finding records the affected package, the advisory, the severity and the affected version range. Findings have a lifecycle the scanner maintains automatically:

• New advisories that match become findings, and fire a vulnerability.detected alert.
• A finding is auto-resolved when a later snapshot no longer matches it: typically because you upgraded the package.
• Findings you have ignored stay ignored across rescans; the scanner will not keep re-raising noise you have already triaged.

Alerts

When a scan produces new findings, the project's notification channels subscribed to vulnerability.detected are notified, so a freshly disclosed CVE in one of your dependencies reaches the team without anyone refreshing a dashboard.

Outdated packages

Beyond security advisories, every snapshot is also checked for freshness: each package's installed version is compared to its latest stable release on Packagist. The project's Dependencies tab lists installed vs latest versions with an Outdated badge (dev-main / RC checkouts are never flagged, they are deliberate choices), and the project overview shows an Outdated packages counter. Freshness is best-effort: a Packagist hiccup never affects the security scan.

What's next

• Subscribe a channel to vulnerability.detected in Alerting.
• Schedule monitor:dependencies in your app so snapshots stay fresh after every deploy.