Composer's autoloader maps class names to files using psr-4, psr-0 and classmap rules, loading a file only when a class is first used. The files rule is different: it loads listed files on every request. Classmap-authoritative makes the autoloader trust only a prebuilt class map.
The autoload rules
| Rule | How it works | Loads code when |
|---|---|---|
| psr-4 | Maps a namespace prefix to a directory | A class in that namespace is first used |
| psr-0 | Older mapping, also supports PEAR style names | A class is first used |
| classmap | Built by scanning php and inc files in listed paths | A class in the map is first used |
| files | Lists files to require explicitly | Every request |
The Composer schema documentation describes the files mechanism as the way to require certain files explicitly on every request. Files from the root package load last, so they cannot override functions defined by dependencies. PSR-4 is the preferred option for new code.
Why security reviewers care
Most autoloading is lazy, so a package's code does not run until you call it. A files entry is the exception: its code executes at startup. In a review of a new dependency, check its composer.json for files entries and read those files first. A harmless helper file is common. An unexpected one deserves a closer look.
What classmap-authoritative does
With the optimize step, Composer converts psr-4 and psr-0 rules into a classmap for speed. With classmap-authoritative, the autoloader loads classes only from that map and does not fall back to scanning the filesystem. The documentation notes it implies the optimize option.
| Setting | Behaviour |
|---|---|
| optimize-autoloader | Builds a classmap for faster lookup |
| classmap-authoritative | Loads classes only from the classmap |
| apcu-autoloader | Caches found and not found lookups in APCu |
For production, a fixed map has a modest security upside: a stray file dropped into a source directory after the build is not picked up as a class. It is not a substitute for locking down write permissions on the server.
Steps for a production build
- Install without development packages.
- Dump the autoloader with the authoritative option.
- Exclude test classes from the map with exclude-from-classmap if needed.
- Deploy the built artifact and keep the web server read only.
composer install --no-dev
composer dump-autoload --classmap-authoritative --no-dev
Try it yourself
Click through it at your own pace, or open it full screen. Compare code that is installed with code your application actually loads.
Where Safeguard fits
Safeguard's reachability analysis helps separate advisories your code can reach from those it cannot. You can try a free scan on your own lock file.
Quick check
Does psr-4 autoloading run code at install?
No. It loads a class file when the class is first used at runtime.
Is classmap-authoritative safe to use in development?
It can surprise you, since new classes will not load until you dump the autoloader again. It is meant for production.
Sources
Last reviewed: 19 October 2026.
