Psalm plugin for Laravel

Laravel static analysis with built-in security scanning.

The only free tool that combines deep Laravel type analysis with taint-based vulnerability detection. Catches SQL injection, XSS, SSRF, shell injection, file traversal, and open redirects — without running your code.

Already using Larastan? psalm-plugin-laravel complements it with security analysis that PHPStan cannot provide.

Security scanning

Plugin ships Laravel-specific taint stubs that track user input from source to sink across your entire codebase. Unlike pattern-matching tools, Psalm follows dataflow across function boundaries — catching vulnerabilities that simpler scanners miss.

// psalm-plugin-laravel catches this:
Route::get('/search', function (Request $request) {
    $query = $request->input('q');
    DB::statement("SELECT * FROM users WHERE name = '$query'");
    // TaintedSql: user input flows directly to the SQL query
});

Taint analysis also works across helper functions, service classes, and any number of call layers:

// Cross-function taint flow — pattern-matching tools miss this:
function getUserQuery(Request $request): string {
    return "SELECT * FROM users WHERE name = '" . $request->input('name') . "'";
}

Route::get('/users', function (Request $request) {
    DB::statement(getUserQuery($request));
    // Psalm catches this: taint flows Request -> getUserQuery() -> DB::statement()
});

What it detects

Security scanning runs automatically alongside type analysis — no extra configuration needed.

How it compares

Quickstart

Step 1: Install

Since Psalm 7.x is currently in beta, allow dev (or beta) packages first:

composer config minimum-stability dev && composer config prefer-stable true
composer require --dev psalm/plugin-laravel

Step 2: Set up Psalm

Initialize a config and enable the plugin:

./vendor/bin/psalm --init
./vendor/bin/psalm-plugin enable psalm/plugin-laravel

Then add these recommended attributes to your psalm.xml:

<psalm
    findUnusedCode="false"
    ensureOverrideAttribute="false"
/>

Step 3: Run

./vendor/bin/psalm

Security taint analysis runs automatically — no extra flags needed.

Existing projects: the first run will likely report many issues. Create a baseline to suppress them and focus only on new code:

./vendor/bin/psalm --set-baseline=psalm-baseline.xml

From here, gradually increase errorLevel (start at 4, work toward 1) and shrink the baseline over time.

Configuration

You can customize Psalm configuration using XML config and/or cli parameters.

See docs/config.md for all configuration options.

Custom checks

The plugin ships advanced Laravel-aware static analysis checks that extend Psalm's built-in diagnostics. See docs/issues/index.md for the full catalog.

Versions & Dependencies

Maintained versions:

(Older versions of Laravel, PHP, and Psalm were supported by version 1.x of the plugin, but they are no longer maintained)

See releases for more details about supported PHP, Laravel and Psalm versions. Upgrading from v3? See the v3 → v4 upgrade guide.

How it works

Under the hood it reads Laravel's native @method annotations on facade classes and generates alias stubs based on Illuminate\Foundation\AliasLoader (including aliases from your config/app.php and package discovery). It also ships hand-crafted stubs for taint analysis and special cases.

It also parses SQL schema dumps (php artisan schema:dump) and PHP migration files to infer column names and types in your database models.

psalm-plugin-laravel or Larastan?

Use both. They solve different problems:

• Larastan excels at Laravel-specific type rules: model-property validation, view-string checks, and 17+ custom rules.
• psalm-plugin-laravel in addition to type checks, it provides taint-based security analysis that PHPStan structurally cannot offer, plus deep type support for auth guards, Eloquent attributes, scopes, attributes, etc.

Psalm and PHPStan use almost the same annotation syntax, so they work side by side without conflicts.

Larastan checks your types. We check your security. Use both.

Contributing

Maintained by @alies-dev. PRs and issues welcome — first-time contributors too. There are contributing docs that may help you (and your agents) with contributions.

Areas where help is especially needed:

• Taint analysis coverage — adding a stub is 5–15 lines of annotations and protects thousands of apps. See the authoring guide.
• Type inference for Laravel magic (Eloquent, Facades, Collections)
• New checks that enforce Laravel best practices