Feature

Composer dependency security scanning

Your composer.lock checked against the Packagist advisories, with the vulnerable packages and the ones that have fallen behind, and an alert when something appears.

Start for free Read the documentation
Sending the lock 
php artisan monitor:dependencies

The problem

A hole in a dependency does not show in your code. It is published on a Tuesday, it concerns a package you never chose but one of your dependencies pulls, and nothing in your application will behave differently to tell you.

What you get

  • One alert on discovery, grouped per scan, not one per package
  • Findings that resolve themselves as soon as the update lands
  • The link to the original advisory, so you can judge for yourself
  • Packages that are behind, told apart from packages that are vulnerable
  • The count on the project's dashboard
  • A scan on demand, or in your integration pipeline

How it works

01

Your lock, not your code

One command sends the list of installed packages and their versions. No source is read and no file is uploaded.

02

Checked against published advisories

Version constraints are compared with composer/semver, so a fixed version stops being reported without you closing anything.

03

Falling behind, counted separately

The latest stable releases are compared with yours. A dev-main or RC install is never flagged: that is a choice, not an oversight.

Start for free

No card required. Up and running in minutes.

All features