Product Decisions This Supports

Shifts security left by automating detection of critical vulnerabilities (XSS, SQLi, RCE) during development, reducing post-release remediation costs
Validates "build" over "buy" for SAST needs: free, open-source alternative to commercial tools with Wikimedia's proven scalability and no vendor lock-in
Supports compliance with OWASP Top 10, PCI-DSS, and internal security policies through continuous vulnerability scanning in CI/CD pipelines
Enables secure coding standards enforcement via customizable taint tracking annotations, reducing manual code review burden

When to Consider This Package

Adopt when: your team uses Phan for static analysis already; you develop MediaWiki extensions or generic PHP projects needing taint-based security checks; you prioritize early vulnerability detection in CI/CD; you have PHP expertise to manage annotations for false positives
Look elsewhere when: your team doesn't use static analysis tools and lacks capacity to adopt Phan; you require dynamic testing (DAST) or runtime protection; your codebase uses complex frameworks where taint tracking is unreliable; false positive rates would overwhelm your team without dedicated security resources

For executives: "This open-source tool integrates with our existing PHP workflow to automatically catch critical security flaws like XSS and SQL injection before production. It eliminates licensing costs while reducing breach risks and compliance costs—proven by Wikimedia's large-scale use."
For engineering: "Seamless Phan integration with minimal config. Customize taint rules via docblocks to suppress false positives and handle custom escaping. Prioritize critical issues via severity filtering, and catch vulnerabilities earlier in the development lifecycle without disrupting workflows."