The PHP analyser is triggered when a “composer.json” or “composer.lock” is found in the root of the project.
When operating on a PHP project the analyser will directly load the dependencies from the lock file. If a “composer.json” is found but not the lock, this will be generated using “composer install”.
The scanner works on:
This analyser cannot work remotely