# Introducing WP Sec Adv as a WP Packages Supplement

**URL:** https://discourse.roots.io/t/introducing-wp-sec-adv-as-a-wp-packages-supplement/30238
**Category:** bedrock
**Tags:** wp-packages, bedrock
**Created:** 2026-03-16T19:03:49Z
**Posts:** 1

## Post 1 by @TangRufus — 2026-03-16T19:03:49Z

During a job interview, the interviewer asked about my experiences using Composer in WordPress projects. Trying to be clever, I listed all the problems mixing Composer with WordPress ecosystem.

Instead of using my [9-year old composer plugin](https://github.com/typisttech/imposter-plugin) as the proof, foolish me decided build something new to showcase how miserable WordPress developers are. Here comes **WP Sec Adv** - a Composer repository for WordPress security advisories.

```
$ composer repo --append add wpsecadv composer https://repo-wpsecadv.typist.tech
$ composer audit
```

Composer resolver blocks known vulnerabilities and fails `compsoer update|require`. Every Bedrock project contains known CVEs. If you don’t see at least 2 vulnerabilities, you are doing it wrong.

Same as WP Packages philosophy: Independent, fully open source, community-funded (I hope - it is waiting for [your sponsorship](https://github.com/sponsors/tangrufus)) and all that jazz.

Works with [WP Packages](https://wp-packages.org/), [WPackagist](https://wpackagist.org/), [Satis](https://github.com/composer/satis), [Private Packagist](https://packagist.com/) and plugins shops’ own Composer repositories, etc.

Learn more at [typisttech/wpsecadv](https://github.com/typisttech/wpsecadv#wp-sec-adv)

Needless to say, the interviewer wasn’t impressed. I am still available for hire. My DM is open.

---

## Post 2 by @system — 2026-03-26T17:11:18Z



---

## Post 3 by @system — 2026-03-26T17:59:32Z