A Laravel or Symfony app operates out of the public/ directory, so composer.json shouldn’t need any blocking typically - it’d be outside the web root.