Doesn't github do that with the dependabot alerts, for free? On each push and via email. Why would you pick this one when you get that without even turning it on
There are 2 problems with dependabot,
1: it requires you to have a code on github orherwise you can't receive alerts
2: they send months old alerts, even if you go to check security advisory of github, you'll notice the date of those issues will be very old.
Yeah, you can just upload a composer.lock file and that's it,
we will track all of the open source you use and even the software that comes under first level. I.e we track the complete graph.
Well, actually we track all of the CVE lists, security advisories of vendors, package managers and as soon as there's an issue related to the software you use, we notify you.
That's it.
