Weave Code
Phpstan Sensitive Parameter Values Laravel Package
lychee-org/phpstan-sensitive-parameter-values
A PHPStan rule that flags sensitive values like passwords, tokens, and API keys passed directly as literal arguments to functions and methods, helping you catch hardcoded secrets before they reach your codebase.
lychee-org/phpstan-sensitive-parameter-values is a PHPStan extension that flags sensitive values passed as parameters in your code. It catches hardcoded credentials, API keys, tokens, and passwords before they reach production, complementing PHPStan's static analysis with security-focused rules.
- Detects sensitive string values passed directly to parameters
- Configurable parameter names and custom sensitive patterns
- Integrates seamlessly with existing PHPStan and Laravel setups
- Reports actionable errors during static analysis and CI runs
- Lightweight, with zero runtime overhead
Frequently asked questions about Phpstan Sensitive Parameter Values
- How do I install lychee-org/phpstan-sensitive-parameter-values in a Laravel app?
- Install it as a dev dependency with composer require --dev lychee-org/phpstan-sensitive-parameter-values. Then add the extension to your phpstan.neon, either under includes or services depending on the package instructions, and run vendor/bin/phpstan analyse as usual. It is a development and CI tool only, so it does not ship to production or change runtime behavior.
- Does this PHPStan extension support Laravel 10, 11, and 12?
- The extension is framework-agnostic and does not hook into Laravel itself, so Laravel 10, 11, or 12 compatibility depends on your PHP and PHPStan versions. In practice you need PHP 8.2 or newer for #[SensitiveParameter], and Laravel 11 and 12 already require PHP 8.2+. Confirm the package's Composer constraints against your pinned Laravel, PHP, and PHPStan versions before adopting.
- Which PHP and PHPStan versions does this package require?
- It is designed around PHP 8.2+ for #[SensitiveParameter] and PHP 8.3+ for #[SensitiveParameterValue] flow, and it must be compatible with your pinned PHPStan major. The exact Composer constraints are declared in the package's composer.json, so check them against your CI image and PHPStan version. Version matching is the main integration risk; a mismatch can make the extension silently redundant or fail to load.
- What kind of sensitive parameters does this rule detect?
- It flags sensitive values passed into function parameters, such as passwords, tokens, API keys, and request credentials, when the receiving parameter should be marked with #[SensitiveParameter]. The goal is to catch secret leakage into logs, error messages, stack traces, and API responses before it reaches production. It is a static-analysis rule, not a runtime redaction library.
- Does it handle #[SensitiveParameterValue] and getValue() return-type flow?
- The extension is intended to teach PHPStan how SensitiveParameterValue propagates, including values returned by getValue() and nested wrapping, so they stay tracked in the analyzer. This matters on PHP 8.3+ where SensitiveParameterValue is available. Because PHPStan's native handling of these attributes is evolving, verify the specific getValue() and nesting cases you rely on with a small reproduction.
- Is this extension redundant if PHPStan already understands SensitiveParameter?
- Possibly. PHPStan's native support for SensitiveParameter and SensitiveParameterValue is evolving, and if your current configuration already catches the patterns you care about, this extension adds little. The right test is to reproduce a concrete false negative your existing analysis misses, then confirm the extension catches it without new noise. Do not adopt it just for the badge; adopt it for a gap it closes.
- How does it interact with my existing phpstan.neon, baseline, and ignore comments?
- It is a normal PHPStan extension, so it should respect your baseline file and ignore comments like other rules, but you should test that interaction rather than assume it. Adding it can surface new errors that require baseline updates or targeted ignores. Check compatibility with your strict-rules and framework extensions in a branch before changing the merge gate.
- Can it produce false positives or false negatives and block CI merges?
- Yes, any static-analysis extension can produce false positives that block merges or false negatives that create a false sense of security. Start at your current analysis level, review every new error, and baseline only after confirming the finding is intentional. Run it in CI via your existing vendor/bin/phpstan analyse step so failures are visible and reproducible.
- Does passing this rule guarantee secrets will not leak at runtime?
- No. The #[SensitiveParameter] attribute affects stack-trace rendering, and this extension only affects type flow inside PHPStan; neither guarantees that secrets never reach logs, dumps, or error trackers. Keep runtime redaction, log scrubbing, secret managers, and code review in place. Treat this as one correctness aid, not a security control.
- Who maintains this package and what happens if it breaks on a PHPStan major?
- It is a LycheeOrg package with effectively no external validation at the time of evaluation, so bus factor and upstream responsiveness are real risks. Pin the version, assign an internal owner, and have a fallback: an internal fork, a local one-file PHPStan extension, or dropping it if upstream PHPStan absorbs the behavior. Re-check it on every PHPStan major upgrade.
Weaver
How can I help you explore Laravel packages today?