What are the security implications in disclosing the
composer.lock file for a remote, public known, web application?
As composer can describe the
exact version numbers, and are useful to communicate the version you tested with to colleagues or when publishing an application
Revealing the version of the underlying library can be used against the application.
composer.lock file also ensures consistency across clusters of servers
It will ensure that all the servers behind a Load balance will be evenly vulnerable which will make the exploit more stable against a target.