psalm/plugin-laravel
Psalm plugin for Laravel that adds deep framework-aware static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, file traversal, and open redirects by tracking user input flows across functions and services.
Emitted when __() or trans() references a translation key that does not exist in the application's language files.
If the translation key doesn't exist, Laravel returns the key itself as a string instead of the translated text. This silently produces untranslated output at runtime. This check catches typos and missing keys during static analysis.
// Bad -- typo in the translation key
echo __('mesages.welcome'); // MissingTranslation
// Good -- the key exists in lang/en/messages.php
echo __('messages.welcome');
// Bad -- key was removed from language files
echo trans('auth.old_message'); // MissingTranslation
// Good
echo trans('auth.failed');
lang/en/messages.php or lang/en.json)__('package::file.key')) -- namespaced keys are not checked by this ruleThis check is disabled by default. Enable it in your psalm.xml:
<plugins>
<pluginClass class="Psalm\LaravelPlugin\Plugin">
<findMissingTranslations value="true" />
</pluginClass>
</plugins>
pagination::pages.next) are skipped__() and trans() are checked -- trans_choice(), Lang::get(), and Blade [@lang](https://github.com/lang) directives are not detectedHow can I help you explore Laravel packages today?