Psalm plugin for Laravel

Laravel static analysis with built-in security scanning.

The only free tool that combines deep Laravel type analysis with taint-based vulnerability detection. Catches SQL injection, XSS, SSRF, shell injection, file traversal, and open redirects — without running your code.

Already using Larastan? psalm-plugin-laravel complements it with security analysis that PHPStan cannot provide.

Security scanning

Plugin ships Laravel-specific taint stubs that track user input from source to sink across your entire codebase. Unlike pattern-matching tools, Psalm follows dataflow across function boundaries — catching vulnerabilities that simpler scanners miss.

// psalm-plugin-laravel catches this:
Route::get('/search', function (Request $request) {
    $query = $request->input('q');
    DB::statement("SELECT * FROM users WHERE name = '$query'");
    // TaintedSql: user input flows directly to the SQL query
});

Taint analysis also works across helper functions, service classes, and any number of call layers:

// Cross-function taint flow — pattern-matching tools miss this:
function getUserQuery(Request $request): string {
    return "SELECT * FROM users WHERE name = '" . $request->input('name') . "'";
}

Route::get('/users', function (Request $request) {
    DB::statement(getUserQuery($request));
    // Psalm catches this: taint flows Request -> getUserQuery() -> DB::statement()
});

What it detects

Security scanning runs automatically alongside type analysis — no extra configuration needed.

How it compares

Versions & Dependencies

Maintained versions:

(Older versions of Laravel, PHP, and Psalm were supported by version 1.x of the plugin, but they are no longer maintained)

See releases for more details about supported PHP, Laravel and Psalm versions. Upgrading from v3? See the v3 → v4 upgrade guide.

Quickstart

Step 1: Install

composer require --dev psalm/plugin-laravel

Step 2: Configure

If you didn't use Psalm on the project before, you need to create a Psalm config:

./vendor/bin/psalm --init

Step 3: Enable the plugin:

./vendor/bin/psalm-plugin enable psalm/plugin-laravel

Step 4: Run

Run your usual Psalm command:

./vendor/bin/psalm

Security taint analysis runs automatically as part of the standard analysis in Psalm 7. No extra flags are needed.

Step 5 (existing projects): Create a baseline

On an existing codebase, the first run will likely report many issues. A baseline file lets you suppress all current issues and focus only on new code:

./vendor/bin/psalm --set-baseline=psalm-baseline.xml

From here, gradually increase errorLevel (start at 4, work toward 1) and shrink the baseline over time.

Configuration

You can customize Psalm configuration using XML config and/or cli parameters.

See docs/config.md for all configuration options.

Custom issues

The plugin emits custom issues beyond Psalm's built-in checks:

• NoEnvOutsideConfig — env() called outside config/ directory
• InvalidConsoleArgumentName — argument() references undefined command argument
• InvalidConsoleOptionName — option() references undefined command option
• MissingView — view() references a non-existent Blade template (opt-in)
• MissingTranslation — __() or trans() references an undefined translation key (opt-in)
• ModelMakeDiscouraged — Model::make() used instead of new Model()

How it works

Under the hood it reads Laravel's native @method annotations on facade classes and generates alias stubs based on Illuminate\Foundation\AliasLoader (including aliases from your config/app.php and package discovery). It also ships hand-crafted stubs for taint analysis and special cases.

It also parses SQL schema dumps (php artisan schema:dump) and PHP migration files to infer column names and types in your database models.

psalm-plugin-laravel or Larastan?

Use both. They solve different problems:

• Larastan excels at Laravel-specific type rules: model-property validation, view-string checks, and 17+ custom rules.
• psalm-plugin-laravel in addition to type checks, it provides taint-based security analysis that PHPStan structurally cannot offer, plus deep type support for auth guards, Eloquent attributes, scopes, attributes, etc.

Psalm and PHPStan use almost the same annotation syntax, so they work side by side without conflicts.

Larastan checks your types. We check your security. Use both.

Contributing

Maintained by @alies-dev. PRs and issues welcome — first-time contributors too. There are contributing docs that may help you (and your agents) with contributions.

Areas where help is especially needed:

• Taint analysis coverage — adding a stub is 5–15 lines of annotations and protects thousands of apps. See the authoring guide.
• Type inference for Laravel magic (Eloquent, Facades, Collections)
• New checks that enforce Laravel best practices