How to Check for Known Security Vulnerabilities in Your DependenciesEdit this page
Warning: You are browsing the documentation for Symfony 4.0, which is no longer maintained.
Read the updated version of this page for Symfony 6.1 (the current stable version).
When using lots of dependencies in your Symfony projects, some of them may
contain security vulnerabilities. That's why Symfony provides a command called
security:check that checks your
composer.lock file to find any known
security vulnerability in your installed dependencies.
First, install the security checker in your project:
$ composer require sensiolabs/security-checker
Then run this command:
$ php bin/console security:check
A good security practice is to execute this command regularly to be able to update or replace compromised dependencies as soon as possible. Internally, this command uses the public security advisories database published by the FriendsOfPHP organization.
security:check command terminates with a non-zero exit code if
any of your dependencies is affected by a known security vulnerability.
Therefore, you can easily integrate it in your build process.
The security checker is also available as an independent console application and distributed as a PHAR file so you can use it in any PHP application. Check out the Security Checker repository for more details.