# Is your PHP project exposed? Source: https://libwatch.com/en/tools/composer-check Free tool ยท PHP and Composer Drop your composer.lock: you instantly see the PHP version it expects and when that version reaches end of life. The full vulnerability report arrives by email. 1. Drop the file Preferably composer.lock: it gives the exact versions. 2. Read the preview Computed in your browser, before anything is sent. 3. Get the report Vulnerabilities in your packages and in the PHP engine, then an alert if a new vulnerability affects you. A composer.lock doesn't contain your code, only the list of your dependencies. We keep only that list, and for 14 days at most. After you send it ## What you'll receive, and nothing more The report arrives within a few minutes. If you tick the box and then activate monitoring with one click in the email, LibWatch watches the list for 14 days and only emails you when it matters. The emails stop as soon as you create an account. 1. Within a few minutes ### Your report PHP version, vulnerabilities found in your packages and in the engine, and what to fix first. 2. Nightly, 14 daysif the box is ticked ### An alert, only when needed When a new vulnerability affects a version on your list. Monitoring lasts 14 days: after that, a composer.lock uploaded once no longer describes your project. 3. 2 days laterif the box is ticked ### The details in LibWatch The vulnerability, how likely it is to be exploited, the fixed version. 4. 5 days laterif the box is ticked ### End of life explained PHP 8.2 reaches end of life on December 31, 2026: what it means for you. 5. 9 days laterif the box is ticked ### Monitor all your projects Connect GitHub, GitLab or a WordPress site in two minutes. 6. 12 days laterif the box is ticked ### For agencies and IT service providers One report per project, share links, the Agency plan. 7. 14 days laterif the box is tickedLast email ### End of monitoring and summary The 14-day summary: vulnerabilities found, PHP version, next end-of-life date. Then monitoring stops and your package list is deleted. Your data ## What's kept, and what never is ### Kept - Your email address - The name and version of each package, for 14 days - The declared PHP version, for 14 days ### Never kept - The file itself - Your Composer scripts and private repository URLs - Your code: it isn't in this file ### Deleted - Your email address, in one click from any message - Your package list, after 14 days - Everything, just ask the team Frequently asked questions ## Before you upload your file ### composer.json or composer.lock: which one should I use? composer.lock. It contains the exact installed versions; composer.json only gives ranges, such as ^8.1, so the report will be less precise. ### Does the checker detect PHP2Shell? Yes, through the declared PHP version. PHP2Shell is a vulnerability in the PHP engine, not in a package: the preview flags a branch with no fix, and the report reminds you of the minimum version to install on the server. [All about PHP2Shell](/en/cve/php2shell). ### Can I check several projects? Yes, one file at a time: each upload sends its own report. To monitor all your projects every night without uploading files, connect them to [LibWatch](/en/ecosystems/php-composer). ### Why do I need to give an email address to get the report? The report compares each package with every known vulnerability, which takes a little longer than a preview. It goes out within minutes. If you don't tick the box, you only receive this report. If you do, one click in the email activates 14-day monitoring: without that click, we only email you once more, the next day.