security-monitoring.md

Security Monitoring

Security Monitoring allow to send notifications when found a security problem in your composer.lock. By default, used packagist.org database.

Packeton is automatically check the main branch of every repository if the composer.lock is exists. You need to configure notifications webhook to receive notification if found a new security issue. Also, you may see list of security advisories in the package page.

Configure Webhook Notifications

Go to Webhook page and click the "Add Webhook". Please fill the form.

Form	Description
Name	Any name
Url	Target url address. For example https://api.telegram.org/bot${secrets.TOKEN}/sendMessage
Method	POST
Request options	Symfony HTTP client options (like custom headers, auth) JSON
Payload	Twig render payload

For example request payload for telegram. It will send JSON request, because response is array

{% set text = "New security issue *#{package.name}*\n\n" %}
{% for advisory in advisories %}
    {% set text = text ~ "#{advisory.title}\nPackage: *#{advisory.packageName}* #{advisory.version}\n" %}
    {% set text = text ~ (advisory.cve and advisory.link ? "[#{advisory.cve}](#{advisory.link})\n" : "Advisory: #{advisory.advisoryId}\n") %}
    {% set text = text ~ "Reported at: #{advisory.reportedAt}\n\n" %}
{% endfor %}

{% set response = {
    'chat_id': '${secrets.CHART_ID}',
    'text': text,
    'parse_mode': 'Markdown'
} %}

{% return response %}

Twig vars: advisories - list of advisories Composer\Advisory\SecurityAdvisory package - package object.

Where ${secrets.CHART_ID} ${secrets.TOKEN} replace with secrets or hardcode this params. See webhooks docs.