Dependency Manifest Scanner
Detects accessible package.json or composer.json files that reveal your exact dependencies and versions.
What it checks
This scanner checks whether dependency manifest files like package.json or composer.json are publicly accessible on your site. It detects when they are served and reveal the list of libraries you use along with their exact versions.
Why it matters
Knowing your exact dependencies and versions makes it easy for an attacker to look up public vulnerabilities that affect precisely what you use. It is reconnaissance work you save them, and it narrows down where to try attacking your site.
How to fix it
Make sure these manifest files aren't served from the public folder; they normally belong in the project root, not the web directory. Block their access in your server or CDN configuration if your framework exposes them by default.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free