Weave Code
Plugin Laravel Laravel Package
psalm/plugin-laravel
Laravel static analysis with built-in taint-based security scanning: traces user input from request to sink to catch SQL injection, XSS, shell injection, file traversal, SSRF, open redirects and timing-unsafe secret comparisons. Runs locally and in CI, no account or cloud upload.
Laravel Psalm Plugin brings deep static analysis to Laravel projects, combining type checking with built-in taint-based security scanning. It traces user input from request sources to dangerous sinks, catching SQL injection, XSS, shell injection, file traversal, SSRF, open redirects, and timing-unsafe secret comparisons — all locally, with no account, cloud upload, or code leaving your machine. It also complements Larastan with security analysis that PHPStan cannot provide.
- Taint tracking from request input through to sinks
- Fully local: runs inside your project and CI
- Quick setup:
psalm-laravel init, thenanalyze - Modern stack: PHP 8.2+, Laravel 12 and 13
- Pairs with existing PHPStan/Larastan setups
Frequently asked questions about Plugin Laravel
- How do I install psalm/plugin-laravel in a Laravel project?
- Install it as a dev dependency with composer require --dev psalm/plugin-laravel, then run ./vendor/bin/psalm-laravel init to generate the plugin configuration in your project. After that, ./vendor/bin/psalm-laravel analyze runs the analysis with Laravel-aware stubs. Because Psalm 7.x is currently in beta, the docs recommend allowing dev minimum stability while keeping prefer-stable true so only Psalm itself is unstable. Check the versions matrix in the README for the PHP and Laravel requirements of the tag you pin.
- Does psalm-laravel detect SQL injection and other security vulnerabilities?
- Yes. The plugin includes taint-based analysis that traces user input from a source such as Request::input() through your code to a sink like orderBy(), reporting SQL injection, XSS, shell injection, file traversal, SSRF, open redirects and timing-unsafe secret comparisons. Taint flows through Laravel internals such as the HTTP client, FormRequest, event dispatcher and pipelines, so vulnerabilities hidden behind facades are still reported. It is not a replacement for a full penetration test, but it catches the common tainted-data paths during development and CI.
- Does psalm/plugin-laravel upload my code to a cloud service?
- No. Everything runs inside your project and your CI pipeline with no account, no cloud upload and no code leaving your machine. That makes it suitable for closed-source and regulated codebases where external analysis services are not permitted. The only network activity is the normal Composer install of the package itself.
- Can I use psalm-laravel together with Larastan?
- Yes, the two tools are complementary rather than overlapping. Larastan brings Laravel type fidelity to PHPStan, while psalm-laravel adds taint-based security analysis that PHPStan cannot provide. Running both is a reasonable setup, and their findings on Laravel types tend to converge rather than conflict as both improve their stub coverage.
- Why did upgrading psalm-laravel suddenly report many new errors?
- Recent releases restored vendor method signatures on stubbed Laravel classes that had silently resolved to mixed, which made taint flows through the HTTP client, events, form requests and pipelines invisible. Those paths are now analyzable, so previously hidden issues surface as real findings on unchanged code. Treat the upgrade as a behavioral change rather than a patch bump and expect a net increase in reported errors on the first run.
- Which Laravel, PHP and Psalm versions does psalm/plugin-laravel support?
- The current 4.x line requires PHP 8.2 or newer and Laravel 12 or 13, and it runs on Psalm 7.x, which is still in beta. If you need to avoid beta dependencies, the 3.x line runs on stable Psalm 6 with its own Laravel and PHP requirements. Always verify that your Composer constraint matches the actual release tag line before bumping, because a mismatched constraint can silently resolve to an unintended version.
- How do I run psalm-laravel in a CI pipeline?
- Add the plugin as a dev dependency, commit the generated psalm configuration, and run ./vendor/bin/psalm-laravel analyze as a CI step after composer install. Because analysis is fully local, no API keys or secrets are needed in the pipeline. Expect longer runtimes on codebases heavy in facades and pipelines, since the deeper data-flow analysis through previously mixed paths costs extra time, so measure the CI delta at your current thread count.
- Should I regenerate the Psalm baseline after upgrading the plugin?
- Not blindly. A full regeneration after this upgrade would suppress exactly the security issues the new version was built to surface, leaving you with a baseline that hides real findings. Instead, triage the newly reported errors first, fix or explicitly suppress the genuine issues, and only then update the baseline for the remaining noise. Teams that ran earlier versions should also treat their prior baselines as known incomplete across HTTP client, form request, event and pipeline code paths.
- Why does the plugin report mixed types on Laravel facades and HTTP client calls?
- Earlier versions had a stub gap where some vendor methods on Laravel classes resolved to mixed, which is opaque to the data-flow engine and caused silent false negatives. Recent releases restore those signatures, so Http\Client\PendingRequest, Http\Client\Response, Events\Dispatcher, FormRequest, Pipeline and several facades now carry real types and can be analyzed. If you maintain hand-written stubs or suppressions around those shapes, expect some churn as the plugin's tighter docblock types for console, events, mail and relations take effect.
- What are the alternatives to psalm/plugin-laravel for Laravel static analysis?
- Larastan with PHPStan is the most common alternative for Laravel-aware type checking, and the two can run side by side rather than as either-or choices. Psalm's own taint analysis without the plugin covers generic PHP but lacks the Laravel-specific stubs and source-to-sink modeling for Eloquent, facades and the container. The distinguishing feature here is the combination of deep Laravel typing and free, fully local taint-based security scanning.
Weaver
How can I help you explore Laravel packages today?