Composer Security

In this presentation I highlighted the increasing risk that comes from using more and more third-party code in your applications and some steps you can take to mitigate that risk.

I finish by introducing Ensemble, a tool to help automate that security and more.

Transcript

1. Composer Security Harsh truths about your favourite package manager
2. Package managers are great But they’re making us lazy
3. Composer isn’t safe!
4. So… it’s all doom and gloom, then?
5. Top safety tips • Make sure your vendor folder isn’t publicly accessible (especially vendor/bin!) • Use/require the SensioLabs Security Advisories Checker https://security.sensiolabs.org/check • Require the roave/security-advisories meta package • Consider using static analysis tools (e.g. RIPS Tech) and ethical hacking services
6. Use Ensemble! • It automates (almost) all of the above • It works in production - no complex CI configuration • It never sees any of your code and doesn’t need access to your repository • It’s secure - even for non-HTTPS sites/apps • It does some other stuff too! • (It doesn’t perform package updates for you) • It’s FREE during the beta ens.emble.app/register
7. You have been watching... Simon Hamp Senior dev @ Elvie simon.hamp@me.com @simonhamp simonhamp.me Pug pics courtesy of: unsplash.com/@charlesdeluvio