- What is graham-campbell/security used for in a Laravel application?
- It is a Laravel integration for the SensioLabs Security Checker. It wraps the checker in a service provider and exposes an Artisan command that audits your installed Composer dependencies for publicly disclosed vulnerabilities. You use it to catch outdated or compromised packages before they reach production.
- How do I install graham-campbell/security?
- Install it with Composer, typically as a dev dependency since you rarely need it at runtime: composer require --dev graham-campbell/security. Laravel's package auto-discovery registers the service provider automatically, so no manual entry in config/app.php is required on supported versions. After that the security:check command is immediately available.
- How do I run a security check on my dependencies?
- Run php artisan security:check from your project root. The command reads your composer.lock, resolves the installed package list, and submits it to the SensioLabs vulnerability database for analysis. Results are printed to the console, and you can wire the command into scripts or pipelines so a failing result stops a build.
- Which Laravel and PHP versions does this package support?
- The package is a thin wrapper that follows current Laravel releases, but the authoritative answer is always the illuminate/support and php constraints in its composer.json. Check those constraints against your own framework version before upgrading Laravel, because a major framework bump can narrow the supported range and drop older branches. This is exactly the kind of check worth doing during a dependency review rather than after a failed install.
- Should I install it as a dev dependency or a production dependency?
- In almost all cases it belongs in require-dev. Dependency auditing is a development and CI concern, and the package adds no runtime request handling, database footprint, or middleware to your application. Keeping it out of production dependencies means less to deploy and nothing extra loaded in live requests.
- Does it scan my own application code for security issues?
- No. It only audits installed Composer dependencies against a vulnerability database; it does not perform static analysis, taint tracking, or code review of your own classes, Blade templates, or configuration. Treat it as one layer of a wider programme that still includes contextual output escaping, a Content-Security-Policy, and dependency hygiene. If you need code-level analysis, that requires a separate tool.
- How do I use graham-campbell/security in a CI pipeline?
- Run composer install and then php artisan security:check as a pipeline step, and let a non-zero exit status fail the build. Because vulnerabilities are disclosed continuously, a scheduled run against an unchanged lock file still adds value, since a package that was clean last month may have a CVE today. Many teams run it nightly as well as on pull requests.
- Does the security checker need network access to work?
- Yes, by default it relies on the vulnerability database published by SensioLabs, so the machine running the check needs outbound connectivity. If your CI runners are sandboxed, either allow the endpoint or point the underlying checker at a locally mirrored database. Plan for this early, otherwise the command works locally and fails silently in your pipeline.
- What are the alternatives to this package?
- PHP and Composer now ship auditing built in: composer audit scans your lock file against the Packagist security advisories database with no extra dependency. There is also enlightn/security-checker, a maintained fork of the original SensioLabs checker, plus standalone binaries such as local-php-security-checker. This package's value is convenience inside Laravel, so compare against composer audit before adding another dependency.
- Is this package still maintained, and is the underlying checker reliable?
- It is a very thin wrapper maintained by a long-standing Laravel ecosystem contributor, so the real question is the health of the checker it wraps rather than the wrapper itself. The original SensioLabs Security Checker has been deprecated in favour of community forks, so verify which engine and database your installed version actually uses. Check recent releases, the composer.json constraints, and the upstream project's status before making it part of a long-lived pipeline.