diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
new file mode 100644
index 000000000..8236b1cfe
--- /dev/null
+++ b/.github/workflows/security.yaml
@@ -0,0 +1,32 @@
+name: Security Check
+
+on:
+    push:
+        branches: [ main ]
+    pull_request:
+    release:
+        types: [ created ]
+
+jobs:
+    security:
+        runs-on: ubuntu-latest
+        name: PHP Security Checker
+        strategy:
+            fail-fast: false
+            matrix:
+                php: [ '8.1' ]
+        steps:
+            -   name: Checkout
+                uses: actions/checkout@v2
+                with:
+                    fetch-depth: 0
+
+            -   name: Cache the vulnerability database
+                uses: actions/cache@v2
+                id: cache-db
+                with:
+                    path: ~/.symfony/cache
+                    key: db
+
+            -   name: Checks dependencies for known vulnerabilities
+                uses: symfonycorp/security-checker-action@v4
diff --git a/src/Composer/ComposerOrchestrator.php b/src/Composer/ComposerOrchestrator.php
index 6a0f13f05..93914e6dd 100644
--- a/src/Composer/ComposerOrchestrator.php
+++ b/src/Composer/ComposerOrchestrator.php
@@ -130,6 +130,7 @@ private static function generateAutoloadStatements(
 
     private static function retrieveComposerExecutable(): string
     {
+        // TODO: add env variable; check that env variables are not changed in the scoped version
         $executableFinder = new ExecutableFinder();
         $executableFinder->addSuffix('.phar');
 
diff --git a/src/Test/RequiresPharReadonlyOff.php b/src/Test/RequiresPharReadonlyOff.php
index ece84b256..3ca933daa 100644
--- a/src/Test/RequiresPharReadonlyOff.php
+++ b/src/Test/RequiresPharReadonlyOff.php
@@ -23,6 +23,8 @@ trait RequiresPharReadonlyOff
 {
     private function markAsSkippedIfPharReadonlyIsOn(): void
     {
+        // Should be supported in PHPUnit9 already
+        // TOOD: @require setting is missing from the doc; can contribute
         if (true === (bool) ini_get('phar.readonly')) {
             $this->markTestSkipped(
                 'Requires phar.readonly to be set to 0. Either update your php.ini file or run this test with '
diff --git a/tests/BoxTest.php b/tests/BoxTest.php
index 58e9f43d4..b51fc519e 100644
--- a/tests/BoxTest.php
+++ b/tests/BoxTest.php
@@ -1366,6 +1366,7 @@ public function test_it_cannot_compress_the_phar_with_an_unknown_algorithm(int $
     public function test_it_cannot_compress_if_the_required_extension_is_not_loaded(): void
     {
         if (extension_loaded('bz2')) {
+            // TODO: should be supported<
             $this->markTestSkipped('Requires the extension bz2 to not be loaded.');
         }