This PR has several advantages over #214:

1. The Enlightn security checker is licensed under MIT so it can be used in any app. The other PR uses local php security checker which is licensed under AGPLv3, and thus cannot be used by any non-AGPL app.
2. This Enlightn security checker can be pulled in via composer whereas the local-php-security-checker needs to download binaries. This depends on system architecture and needs hacky solutions / shell scripts to make it work.

Looks interesting. Composer.lock is not uploaded anywhere, am I correct?

That's right @zdenekdrahos, it just looks for the lock file in the current directory. It's very similar to how the old Sensiolabs security-checker worked.

Could you support symfony/finder:2? I'd like to keep support for older php and symfony versions.

https://travis-ci.org/github/EdgedesignCZ/phpqa/jobs/756550442#L596
enlightn/security-checker v1.3 requires symfony/finder ^3|^4|^5 but these conflict with your requirements or minimum-stability.

Hey @zdenekdrahos, I've added support all the way upto PHP 5.6 with enlightn/security-checker#6. We need a min of symfony/yaml 3.4 and symfony/console 3.4 for everything to work right now.

Given that 5.6 was EOL in 2018, I think it's a good version to support for now. I'm open to PRs for expanding support though but this as far as I can get for now. Hope that works!