Product Decisions This Supports

Proactive reliability: Enables detection of unsafe PHP patterns (e.g., false-returning functions like file_get_contents()) that could lead to silent failures, reducing production incidents tied to null/undefined behavior.
Build vs. buy: Eliminates need to develop custom static analysis rules for null safety, saving engineering time while maintaining consistency with industry standards (PHPStan).
Roadmap alignment: Supports initiatives for stricter quality gates in CI/CD, particularly for teams adopting thecodingmachine/safe or migrating legacy codebases to stricter type safety.
Use cases:
- Legacy code modernization: Flags unsafe functions (e.g., strpos() without null checks) during refactoring.
- New feature development: Enforces safe patterns (e.g., Safe\file_get_contents()) by default in PRs.
- Security hardening: Detects potential injection risks (e.g., preg_replace without PREG_SET_ORDER flags).

When to Consider This Package

✅ Adopt if:
- Your team uses PHPStan (v1.0+) and wants to enforce null safety or safe function usage without runtime overhead.
- You rely on thecodingmachine/safe or plan to migrate to it—this package automates compliance checks.
- CI/CD pipelines need pre-merge validation for unsafe patterns (e.g., false-returning functions, deprecated APIs).
- Your codebase has medium/high complexity (10K+ lines) where manual reviews miss edge cases.
❌ Avoid if:
- You don’t use PHPStan (consider Psalm or custom linters like phpmd).
- Your project is small/low-risk (e.g., prototypes, scripts) where manual checks suffice.
- You need domain-specific rules beyond null safety (e.g., business logic validation).
- Your team lacks PHPStan expertise—setup requires basic configuration knowledge.

Executives:

"This integrates with our existing PHPStan setup to block critical bugs before they reach production—like null pointer exceptions or unsafe file operations—without adding runtime costs. It’s a zero-effort upgrade to our quality gates, reducing incident response time and improving developer velocity. For example, it caught [X] silent failures in [Y] legacy modules during our last migration."
Engineering (Devs/Tech Leads):

"Drop-in for PHPStan: 1 line in composer.json + 1 line in phpstan.neon starts flagging unsafe patterns like strpos($null) or file_get_contents() without checks. Works alongside thecodingmachine/safe to enforce consistent error handling. Run it in CI to fail builds on unsafe code—no false positives if configured right. Example: [Show before/after PR diff with violations highlighted]."
Security/Quality Teams:

"Reduces attack surface by eliminating false-returning functions (e.g., strpos, json_decode) that can mask errors. Integrates with our existing toolchain—no new infrastructure. Example: Found [Z] vulnerabilities in [legacy module] by catching unsafe regex patterns."