PHP applications don't die of old age, they die of skipped maintenance. In every uncared-for Composer project three things happen silently: new CVEs get published against the actually-installed versions, authors stop maintaining libraries and mark packages as abandoned, major framework branches drop out of security support. After eighteen-twentyfour months of immobility, the application formally works but is exposed to vulnerabilities that have been known and patched in newer versions. This tool surfaces that state in thirty seconds from the manifest alone.
What the audit actually checks. Three independent sources feed the triage. (1) Known vulnerabilities (CVE): the Packagist Security Advisory API aggregates FriendsOfPHP/security-advisories and the GitHub Advisory DB; OSV.dev (Open Source Vulnerabilities, maintained by Google) enriches each advisory with CVSS v3 vector and CWE IDs. Coverage: 6,000+ advisories on 1,000+ Composer packages. (2) End-of-life (EOL): endoflife.date publishes the release cycles of the main frameworks with end-of-security-support dates. Monitored: PHP, Laravel (and illuminate/*), Symfony (and every symfony/*), Composer itself, Guzzle, Twig, CakePHP, Drupal, GrumPHP. (3) Abandoned: the abandoned flag from Packagist is read for the union of all packages mentioned in advisories and the top 2,000 popular packages, with a 7-day cache TTL. Result: 210+ packages flagged as actually abandoned in the dataset.
Difference between auditing the lock and auditing the json. The composer.lock contains exact resolved versions: the matcher does an exact lookup against the advisory's affected interval (e.g. >=9.0.0,<9.5.6). The composer.json contains only the declared constraint (e.g. ^9.0): the matcher computes the intersection between the user constraint and the affected interval, flagging if any installable version is vulnerable. For rigorous audits use the lock. The json is useful to assess whether the constraint would permit downloading vulnerable versions on a fresh composer install tomorrow: triage flags it, but truth lives in production.
The constraint matcher is precise. It does not stop at major-version comparison: it implements caret ^X.Y.Z with the major-zero exception (^0.5.0 = >=0.5.0 <0.6.0, ^0.0.5 = >=0.0.5 <0.0.6), tilde ~X.Y, wildcard X.Y.*, hyphen range 1.0 - 2.0, operators >= <= > < =, OR || and AND comma-or-whitespace, stability suffixes -dev -alpha -beta -RC with lexicographic priority. Normalization is in DNF (disjunctive normal form) of intervals and constraint-vs-constraint intersection is pairwise overlap: same semantics as composer/semver PHP, in vanilla JS, with no dependencies.
Operational privacy. The composer.lock reveals the full structure of a project, its transitive dependencies, and any private packages with references to internal VCS repositories. Uploading it to a third-party service for preliminary analysis is not a good idea, even over TLS: every third party is a leak vector for your dependency map. Here no request leaves with manifest data. The dataset (16 advisory shards + 1 EOL file + 1 abandoned file) is downloaded by the browser only on first use and cached in localStorage for subsequent sessions (automatic invalidation via SHA-256 over the public files). Audit, parsing, matching: all local.
When static triage is the right level. Typical scenarios. (a) Preliminary review of a legacy project without filesystem access: the client pastes the manifest in an email and wants an assessment in thirty seconds. (b) Pre-engagement audit to estimate the cost of a possible remediation contract before quoting. (c) Initial screen before a serious cyber assessment: define the list of high/critical to deepen with exploitability assessment, mapping of applicable vectors, reachability of the codepaths. (d) Periodic self-check by the application owner who wants to know whether the maintainer is doing the work.
Scope limit. The tool flags published CVEs, known EOL, declared abandonment. It does not replace enterprise Software Composition Analysis (Snyk, Mend, Sonatype): no license check, no SBOM CycloneDX generation, no analysis of non-Composer code (system binaries, Node scripts, container base images). It does not replace composer audit CLI integrated into pipelines. It does not replace a manual assessment that evaluates real exploitability of vectors, presence of codepaths in installed versions, mitigations applied at hardening level. It is a triage and presents itself as one.