GrumPHP VS local-php-security-checker

GrumPHP: A PHP code-quality tool.

Depends on what you mean by plugin, but a GrumPHP is a great tool. It registers a pre-commit git hook that runs whatever quality tools you've configured every time someone commits. If one of the checks fail, the commit is aborted. It's very easy to install and configure.

sounds like you heard of Grumphp

Of course, in this simple way, you will need run the command before commits to ensure a correct code style. We can improve this we can to use some pre-commit hook, like a grumphp https://github.com/phpro/grumphp.

How does this compare to existing tools like GrumPHP or Captain Hook? Why should I use it instead?

Are you aware of GrumPHP?

I use grumphp to run phplint, phpstan, Easy coding standard (includes php-cs fixer) and phpunit. All four will automatically run before every commit, stopping any 'below standard' code from being committed. Example config file

like valplet said: https://github.com/phpro/grumphp But also: https://styleci.io/ integrates nicely with git For client side code formatting check: https://prettier.io/

test -d local-php-security-checker || curl -L https://github.com/fabpot/local-php-security-checker/releases/download/v1.2.0/local-php-security-checker_1.2.0_linux_amd64 --output local-php-security-checker chmod +x local-php-security-checker ./local-php-security-checker

The best alternative to use now is to download a local-security-checker binary (https://github.com/fabpot/local-php-security-checker/releases), saving it in the bin folder, and running that binary (via bin/local-php-security-checker).

Local PHP Security Checker: PHP security vulnerabilities checker

It looks like they utilize this repo for advisories: https://github.com/FriendsOfPHP/security-advisories/ -- via https://symfony.com/blog/the-php-security-checker-as-a-docker-image

https://github.com/fabpot/local-php-security-checker

I agree, composer is not perfect, but before it was worse.