Free tool · Lock-file checker
Check your lock files for known advisories.
Drop composer.lock and package-lock.json. Every package is checked against the GitHub advisory database, and PHP, Laravel, Craft and Statamic against their end-of-life dates.
Checking packages
Files stay in this tab. Only package names and versions are sent.
Ranked like Porro
Act now first: high and critical advisories in packages that reach visitors. Build tools such as Vite rank low, whatever the severity.
same ranking as the app
Installed → fixed
Each finding shows the version in your lock file, the first version that fixes it, and a link to the advisory.
GitHub advisory database
End of life
PHP, Laravel, Craft and Statamic versions past security support, or within 90 days of it.
dates from endoflife.date
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.