PHPackages                             padosoft/laravel-composer-security - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. padosoft/laravel-composer-security

ActiveProject[Security](/categories/security)

padosoft/laravel-composer-security
==================================

Security checker for composer.lock.

1.5.1(9y ago)314.1k2[2 PRs](https://github.com/padosoft/laravel-composer-security/pulls)MITPHP

Since Nov 6Pushed 10mo ago7 watchersCompare

[ Source](https://github.com/padosoft/laravel-composer-security)[ Packagist](https://packagist.org/packages/padosoft/laravel-composer-security)[ RSS](/packages/padosoft-laravel-composer-security/feed)WikiDiscussions master Synced 4w ago

READMEChangelog (2)Dependencies (6)Versions (26)Used By (0)

LARAVEL COMPOSER SECURITY COMMAND
=================================

[](#laravel-composer-security-command)

[![Latest Version on Packagist](https://camo.githubusercontent.com/9a02980d0c994c4a06d4a0c61617d0f38a0ad62df060f3e22ec21bcde03e2973/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f7061646f736f66742f6c61726176656c2d636f6d706f7365722d73656375726974792e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-composer-security)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE.md)[![Build Status](https://camo.githubusercontent.com/35cddedcf9d0952eee943756622863db8895674293a6c6b6778662ea8602ee74/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f7061646f736f66742f6c61726176656c2d636f6d706f7365722d73656375726974792f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://travis-ci.org/padosoft/laravel-composer-security)[![Coverage Status](https://camo.githubusercontent.com/8a94193b9d3896740a6f3a1753d97e221c760e87529980f7bcd2ac6c9fcfed78/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f636f7665726167652f672f7061646f736f66742f6c61726176656c2d636f6d706f7365722d73656375726974792e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/padosoft/laravel-composer-security/code-structure)[![Quality Score](https://camo.githubusercontent.com/f9a96160fa408cff4a04edd39486a67b9a6af572e08bc3ed064e21875dea0416/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f7061646f736f66742f6c61726176656c2d636f6d706f7365722d73656375726974792e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/padosoft/laravel-composer-security)[![Total Downloads](https://camo.githubusercontent.com/24202196ddd33ed180817015d0b47beca4fd713cb861db82b17f5b886309b11c/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f7061646f736f66742f6c61726176656c2d636f6d706f7365722d73656375726974792e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-composer-security)[![SensioLabsInsight](https://camo.githubusercontent.com/8c161bfc9a9cf6241edecd84858cfc9f83cbcde389eea4e1ef3ed294e445d8c5/68747470733a2f2f696e73696768742e73656e73696f6c6162732e636f6d2f70726f6a656374732f38306661303433302d353566662d343037392d613334652d6431383961396432316435652f736d616c6c2e706e67)](https://insight.sensiolabs.com/projects/80fa0430-55ff-4079-a34e-d189a9d21d5e)

This is a Laravel 5.1/5.2/5.3 package that provides an artisan command for testing security vulnerabilties into your composer.lock files. Is ready and tested for php7.0 and php7.1 too.

Table of Contents
=================

[](#table-of-contents)

- [LARAVEL COMPOSER SECURITY COMMAND](#laravel-composer-security-command)
- [Table of Contents](#table-of-contents)
- [PREREQUISITES](#prerequisites)
    - [INSTALL](#install)
    - [USAGE](#usage)
        - [EXAMPLE:](#example)
    - [SCHEDULE COMMAND](#schedule-command)
    - [SCREENSHOOTS](#screenshoots)
- [Testing](#testing)
- [Contributing](#contributing)
- [Security](#security)
- [API Documentation](#api-documentation)
- [Credits](#credits)
- [About Padosoft](#about-padosoft)
- [License](#license)

PREREQUISITES
=============

[](#prerequisites)

LARAVEL 5.1+ GUZZLE 6+

INSTALL
-------

[](#install)

This package can be installed through Composer.

```
composer require padosoft/laravel-composer-security
```

You must install this service provider.

```
// config/app.php
'provider' => [
    ...
    Padosoft\LaravelComposerSecurity\ComposerSecurityCheckServiceProvider::class,
    ...
];
```

You don't need to register the command in app/Console/Kernel.php, because it provides by ComposerSecurtyCheckServiceProvider register() method.

You can publish the config file of this package with this command:

```
php artisan vendor:publish --provider="Padosoft\LaravelComposerSecurity\ComposerSecurityCheckServiceProvider"
```

The following config file will be published in `config/composer-security-check.php`

```
return array(
    'mailSubjectSuccess' => env(
        'SECURITY_CHECK_SUBJECT_SUCCESS',
        '[composer-security-check]: Ok - no vulnerabilities detected.'
    ),
    'mailSubjetcAlarm' => env(
        'SECURITY_CHECK_SUBJECT_ALARM',
        '[composer-security-check]: Alarm - vulnerabilities detected.'
    ),
    'mailFrom' => env('SECURITY_CHECK_MESSAGE_FROM', 'info@example.com'),
    'mailFromName' => env('SECURITY_CHECK_MESSAGE_FROM_NAME', 'Info Example'),
    'mailViewName' => env('SECURITY_CHECK_MAIL_VIEW_NAME', 'composer-security-check::mail'),
    'logFilePath' => env('SECURITY_CHECK_LOG_FILE_PATH', storage_path().'/composersecurityCheck.log')
 );
```

In config folder you can copy from .env.example the settings for yours .env file used in composer-security-check.php. If you use mathiasgrimm/laravel-env-validator in config folder you'll find and example for validate the env settings.

USAGE
-----

[](#usage)

When the installation is done you can easily run command to print help:

```
php artisan composer-security:check
```

The `composer-security:check` command looks for every composer.lock file in the given path and foreach composer.lock check for security issues in the project dependencies: `php composer-security:check`

If you omit path argument, command look into current folder.

You can also pass the path as an argument: `php composer-security:check /path/to/my/repos`

You can use \* in path argument as jolly character i.e. `/var/www/*/*/`

By default, the command displays the result in console, but you can also send an html email by using the `--mail`option:

```
php composer-security:check /path/to/my/repos --mail=mymail@mydomain.me
```

### EXAMPLE:

[](#example)

Here is a basic example to check composer.lock into these dir:

```
php artisan composer-security:check "/dir/to/check/*/*/"
```

Here is an example to send output report to mail:

```
php artisan composer-security:check "/dir/to/check/*/*/" --mail=mymail@mydomain
```

Here is an example to ignore two composer.lock vulnerabilities into two dir (if command found any vulnerabilities into these dir, write it into output but the email subject isn't set to ALERT):

```
php artisan composer-security:check "/dir/to/check/*/*/" --mail=mymail@mydomain --whitelist="/dir/to/put/in/witelist,/another/dir/to/put/in/witelist"
```

SCHEDULE COMMAND
----------------

[](#schedule-command)

You can schedule a daily (or weekly etc..) report easly, by adding this line into `schedule` method in `app/Console/Kernel.php` :

```
// app/console/Kernel.php

protected function schedule(Schedule $schedule)
{
    ...
	$schedule->command('composer-security:check "/dir/to/check/" --mail=mymail@mydomain')
            ->daily()
            ->withoutOverlapping()
            ->sendOutputTo(Config::get('composer-security-check.logFilePath'));
}
```

SCREENSHOOTS
------------

[](#screenshoots)

OUTPUT CONSOLE: [![screenshoot](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/console-output.png)](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/console-output.png)

EMAIL VIEW WITH ALERT: [![screenshoot](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/alert-vulnerability.png)](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/alert-vulnerability.png)

EMAIL VIEW WITH VULNERABILITY WITELISTED: [![screenshoot](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/warning-vulerability-witelisted.png)](https://raw.githubusercontent.com/padosoft/laravel-composer-security/master/resources/img/warning-vulerability-witelisted.png)

Testing
=======

[](#testing)

```
$ composer test
```

Contributing
============

[](#contributing)

Please see [CONTRIBUTING](CONTRIBUTING.md) and [CONDUCT](CONDUCT.md) for details.

Security
========

[](#security)

If you discover any security related issues, please email instead of using the issue tracker.

API Documentation
=================

[](#api-documentation)

Please see API documentation at

- [master](https://padosoft.github.io/laravel-composer-security/build/master/)

Credits
=======

[](#credits)

- [Lorenzo Padovani](https://github.com/lopadova)
- [All contributors](https://github.com/thephpleague/skeleton/contributors)

About Padosoft
==============

[](#about-padosoft)

Padosoft is a software house based in Florence, Italy. Specialized in E-commerce and web sites.

License
=======

[](#license)

The MIT License (MIT). Please see [License File](LICENSE.md) for more information.

###  Health Score

42

—

FairBetter than 89% of packages

Maintenance38

Infrequent updates — may be unmaintained

Popularity28

Limited adoption so far

Community14

Small or concentrated contributor base

Maturity73

Established project with proven stability

 Bus Factor1

Top contributor holds 75% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~20 days

Recently: every ~38 days

Total

22

Last Release

3461d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/10467699?v=4)[Lorenzo](/maintainers/lopadova)[@lopadova](https://github.com/lopadova)

---

Top Contributors

[![alevento](https://avatars.githubusercontent.com/u/5909180?v=4)](https://github.com/alevento "alevento (153 commits)")[![lopadova](https://avatars.githubusercontent.com/u/10467699?v=4)](https://github.com/lopadova "lopadova (44 commits)")[![ahahahah](https://avatars.githubusercontent.com/u/2970013?v=4)](https://github.com/ahahahah "ahahahah (7 commits)")

---

Tags

composerlaravellaravel-commandlaravel-packagesecuritycomposersecurity

### Embed Badge

![Health badge](/badges/padosoft-laravel-composer-security/health.svg)

```
[![Health](https://phpackages.com/badges/padosoft-laravel-composer-security/health.svg)](https://phpackages.com/packages/padosoft-laravel-composer-security)
```

###  Alternatives

[spatie/laravel-health

Monitor the health of a Laravel application

87411.3M154](/packages/spatie-laravel-health)[craftcms/cms

Craft CMS

3.6k3.6M2.9k](/packages/craftcms-cms)[jorijn/laravel-security-checker

Added Laravel functionality to the Enlightn Security Checker. Adds a command to check for, and optionally emails you, vulnerabilities when they affect you.

2031.9M1](/packages/jorijn-laravel-security-checker)[spatie/laravel-export

Create a static site bundle from a Laravel app

672139.5k6](/packages/spatie-laravel-export)[laravel/ai

The official AI SDK for Laravel.

1.0k2.1M163](/packages/laravel-ai)[dgtlss/warden

A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email

9056.1k](/packages/dgtlss-warden)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)