composer audit is a handy command that you should know about and definitely implement in your development and security pipelines.

When using the standard Composer repository, packagist.org, which is added implicitly by default, Composer pulls security data from Packagist's feed. This is a combination of GitHub's advisories and the FriendsOfPHP Security Advisories repository.

In the Magento world, this might not be sufficient.

There is a common practice of distributing paid third-party modules through custom repositories. Basically, every module provider offers its own Composer repository containing their paid modules.

When there is a security-related issue with any of these privately distributed packages, Composer has no way of knowing about it. Having a security advisory feed as part of the private repository itself is the right way to solve this.

Having these feeds implemented would greatly improve the security of the entire Magento ecosystem. Unfortunately, implementing this is not that straightforward.

As far as I am aware, there is no official documentation describing this behavior, so I put together a simple specification:

github.com/jbrada/composer-security-advisories-spec

Do you offer modules through a private repository? Add your security advisory feed and benefit from composer audit and the new Composer blocking features introduced in the latest 2.9 and 2.10 versions.

And sharing that you have no security advisories at all is also information.