Remove from Packagist, or make explicit this module should not be used in production

[edlinklater]

Due to the high-risk nature of running this module in production (as per the README), it seems unnecessarily high risk to have this module available in Packagist, particularly under the silverstripe/ namespace (where there would be an expectation of security and stability).

Ideally there would be a way to mark a project as only being able to be used in require-dev, but in the absence of this, I'd propose either:

1. Remove from Packagist, so users need to very explicitly add to their repositories list.
2. (ab)use namespace to make clear that this module isn't "safe" and shouldn't be used in production, e.g. silverstripe-unsafe/testsession.

[assertchris]

I dislike the idea of removing things from Packagist to prevent abuse. Is it installed by any official meta packages (other than those required to run Travis tests)?

If folks can't be bothered to read the warning, after manually including it in their project, then maybe we should let nature take its course...

[edlinklater]

It is included by silverstripe-labs/silverstripe-behat-extension, which is also namespaced as an official SilverStripe package (silverstripe/behat-extension). While users shouldn't be including the Behat extension other than in require-dev, we shouldn't be operating under the assumption that everyone knows how to correctly use Composer.

Personally I don't like removing things from Packagist, and would much prefer to indicate via namespaces the packages that aren't considered by the core team to be safe and production-ready (e.g. most of the things in silverstripe-labs), similar to how Debian uses "backports" and "experimental".

[sminnee]

FYI I've suggested in #42 a refactoring that might address the underlying security weaknesses @edlinklater

[dhensby]

there's been no traction / support for removing this from packagist