Weave Code
Plugin Laravel Laravel Package
psalm/plugin-laravel
Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code without running it.
title: Home nav_order: 1
About plugin
The plugin helps Psalm to understand Laravel's code (which uses a lot of magic) better. There are 2 main ways how it does it:
- easy: by providing stub files (you can find them in
/stubsdir) - medium+: using custom Handlers (see
/src/Handlersdir)
Documentation
- Configuration — plugin XML config options and environment variables
- GitHub Actions — running Psalm in CI with GitHub Actions
- Upgrading to v4 — migration guide from v3
- Contribution:
- Overview — how the plugin works, getting started, adding stubs and handlers
- Architecture Decisions — key design decisions and rationale
- Debugging with Xdebug — stepping through plugin code
- Taint Analysis
- Types — Psalm types and annotations (incl. internal/hidden)
Custom Issues
The plugin emits custom issues that Psalm does not have built-in. Each one links to detailed documentation with examples and fix guidance.
Weaver
How can I help you explore Laravel packages today?