Usage: curl -i -H 'Accept: text/plain' https://php-security-checker.wmcloud.org/check_lock -F lock=@composer.lock

See the source code. Based off of the Friends of PHP security advisories database (bba473bf0857eee6d2adce13f8584c3a4b735dfd).