> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Launch a Scan on a PHP/Composer Project

> Best practices for configuring Composer projects to be scanned by CybeDefend, with an emphasis on lockfiles.

If your PHP application uses **Composer**, CybeDefend can detect vulnerabilities in your `composer.json` and `composer.lock` files. However, you'll get the **best** results if you have a lockfile with pinned dependencies.

## Recommended Steps

1. **Install Dependencies with Composer**\
   Run one of these commands to generate a `composer.lock` file:
   ```bash theme={null}
   # Standard install
   composer install

   # If you encounter platform requirement issues
   composer install --ignore-platform-reqs

   # If you want to just generate the lockfile without installing
   composer update --no-scripts --ignore-platform-reqs --lock
   ```

2. **Commit the Lockfile**\
   Always commit `composer.lock` to your repository. This ensures that the entire team, and CybeDefend, see the exact dependency versions.

3. **Keep Your Lockfile Updated**\
   When you want to update dependencies, use `composer update` or `composer require` and commit the updated lockfile.

## Why You Should Use Lockfiles

Using a **lockfile** is critical for secure and predictable builds. A lockfile contains a **fixed version** and a **hash** for each dependency and sub-dependency in your project.

1. **Supply Chain Protection**\
   Lockfiles prevent malicious package injections. This is crucial as supply chain attacks are rising.
2. **Predictable Builds**\
   Everyone uses the exact same package versions, avoiding “it works on my machine” inconsistencies.
3. **Performance Gains**\
   With dependency versions locked, build tools skip the usual resolution step, making builds faster.

<Note>
  Lockfiles are never edited manually. They’re generated and updated by your package manager and committed to your repository, ensuring consistent environments for all teammates.
</Note>

## Troubleshooting Lockfile Generation

If you encounter issues generating a lockfile, try these approaches:

```bash theme={null}
# Update dependencies while ignoring platform requirements
composer update --no-interaction --no-scripts --ignore-platform-reqs

# Force lockfile regeneration
composer update --no-interaction --no-scripts --ignore-platform-reqs --lock
```

<Note>
  While CybeDefend can scan projects with only a <code>composer.json</code> file, we strongly recommend generating and committing the <code>composer.lock</code> file for more accurate vulnerability detection.
</Note>

## Supported Files for PHP/Composer

| File Examples                    |
| -------------------------------- |
| `composer.json`, `composer.lock` |

<Warning>
  Never edit your <strong>composer.lock</strong> file manually. Always let Composer handle this file to ensure proper dependency resolution.
</Warning>

<Tip>
  If you're using development dependencies, be aware that these are also included in the security scanning. Consider carefully which packages you include, even as development dependencies.
</Tip>