Symfony recipes are just files, and you can read them

Installing a package now writes configuration, adds environment variables and may register a bundle, and the reasonable first reaction is to want to know what it did.

$ composer require symfony/mailer
Symfony operations: 1 recipe (a1b2c3)
  - Configuring symfony/mailer (>=4.3): From github.com/symfony/recipes

$ git status --short
 A config/packages/mailer.yaml
 M .env
 M symfony.lock

$ composer recipes symfony/mailer     # what it installed, and from where

The recipes live in two public repositories — a curated one and a contrib one — and the contrib set prompts before running unless you have accepted it globally. Running composer require on a clean working tree makes the diff readable, which is the practical habit. symfony.lock records which recipe version was applied, so a recipe that changes upstream does not silently change your project.