# fabpot/local-php-security-checker

PHP security vulnerabilities checker

Repository: https://github.com/fabpot/local-php-security-checker
Canonical: https://ross.abutalabs.com/products/local-php-security-checker
Homepage: https://github.com/FriendsOfPHP/security-advisories
Language: Go
License: AGPL-3.0
License Family: copyleft
Topics: php, security, packagist, composer
Archived: true
Last push: 2024-08-02T14:20:08+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2056, "days_push": 761, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1182, forks 77 (observed 2026-08-28T04:03:54.228847+00:00)

## What it is
A command-line tool that checks PHP applications using Composer for dependencies with known security vulnerabilities, backed by the FriendsOfPHP Security Advisories Database. The repository is now archived and users are directed to use `composer audit` instead.

## Use cases
- check composer.lock for known vulnerabilities
- audit php dependencies for security advisories
- scan php project for vulnerable packages in ci
- run scheduled security checks on production php app
- output vulnerability report as json or junit

## When to choose
- you need a standalone binary without composer installed
- you want junit/json output for legacy CI pipelines
- you are maintaining an older toolchain that already uses it

## When to avoid
- starting a new project - use `composer audit` instead
- you need actively updated vulnerability data going forward
- you need scanning for non-PHP ecosystems

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: security, vulnerability-scanning, dependency-audit, cli
- domain: security, developer-tools
- platform: cli, windows, cross-platform
- tags: composer, packagist, php-security, archived, security-advisories, php, command-line, linux, macos

## Member repositories
- fabpot/local-php-security-checker (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:54.228847+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:24:50.190744+00:00, confidence not recorded.
  - readme: https://github.com/fabpot/local-php-security-checker (fetched 2026-08-28T04:03:54.228847+00:00, sha 1d6f0f51015b)
  - homepage: https://github.com/FriendsOfPHP/security-advisories (fetched 2026-08-29T12:31:40.520390+00:00, sha 31ee45fb987c)
- Data as of 2026-08-30T08:39:29.467469+00:00.