psalm/plugin-laravel
Psalm plugin for Laravel that adds deep framework-aware static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, file traversal, and open redirects by tracking user input flows across functions and services.
Emitted when Model::make() is used instead of new Model().
Model::make() is forwarded through magic methods (__callStatic -> __call -> forwardCallTo) to Builder::make(), which just creates a new instance via newModelInstance(). Using new Model($attributes) is clearer and avoids the indirection.
// Bad — unnecessary indirection through magic methods and Builder
$post = Post::make(['title' => 'Hello']);
// Good — direct construction, easy to follow
$post = new Post(['title' => 'Hello']);
Replace Model::make($attributes) with new Model($attributes).
How can I help you explore Laravel packages today?