psalm/plugin-laravel
Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code without running it.
The plugin ships advanced Laravel-aware static analysis checks that extend Psalm's built-in diagnostics:
env() called outside the application's config directoryargument() references undefined console command argumentoption() references undefined console command optionview() references a non-existent Blade template (opt-in)__() or trans() references an undefined translation key (opt-in)Model::make() used instead of new Model()singleton() closure resolves a request-scoped service such as Request, Session, or Auth (auto-enabled when laravel/octane is installed)public #[Scope] Eloquent query scope, whose static call is a runtime fatal (reported at error levels 1 to 4)public legacy getXxxAttribute() / setXxxAttribute() accessor or mutator, a pure convention nit (reported at error level 1)query() entry point (opt-in)Each issue page explains what it detects, why it matters, and how to fix it.
How can I help you explore Laravel packages today?