Download the PHP package psalm/plugin-laravel without Composer

Laravel Psalm Plugin

Laravel static analysis with built-in security scanning.

The only free tool that combines deep Laravel static analysis with taint-based vulnerability detection that traces user input from request to sink: SQL injection, XSS, shell injection, file traversal, SSRF, open redirects, timing-unsafe secret comparisons, and LLM prompt injection (laravel/ai agents). Everything runs inside your project and your CI. No account, no cloud upload, no code leaves your machine.

Real output on a fresh Laravel app, tracing the two lines above from source to sink.

[!NOTE] Already using Larastan? psalm-laravel complements it with security analysis that PHPStan cannot provide. See the comparison below.

Install

Requires PHP 8.2+ and Laravel 12 or 13. Full matrix under Versions & Dependencies.

• Psalm 7.x is currently in beta, which is the only reason dev stability is needed. prefer-stable true keeps every other package in your project on stable releases, so Psalm itself is the single beta you pull in.
• Want zero beta packages? The 3.x line runs on stable Psalm 6 and needs no stability flags at all: composer require --dev psalm/plugin-laravel:^3. It carries the same security checks, and additionally supports Laravel 11.
• init writes a psalm.xml at the project root with the plugin enabled, errorLevel="4" by default (--level 1 is strictest, --level 8 the most lenient), Laravel-friendly issue handler defaults, and runTaintAnalysis="true". Pass --force to overwrite an existing psalm.xml without prompting.
• analyze delegates to vendor/bin/psalm and passes the exit code through, so you can invoke ./vendor/bin/psalm directly instead.

On the 3.x line (Psalm 6) security scanning is a separate mode rather than an extra check: enabling it makes Psalm report Tainted... issues and suppress every type issue. Keep runTaintAnalysis out of your psalm.xml there, which is why init on 3.x omits it, and pass the flag only for the security pass. Putting it in the config turns every run taint-only, including the --set-baseline run below.

Psalm 7, and therefore the 4.x plugin line, merged the two: one run reports both.

Security scanning

Plugin ships Laravel-specific taint stubs that track user input from source to sink across your entire codebase. Unlike pattern-matching tools, Psalm follows dataflow across function boundaries, so input that travels through helper functions, service classes, and any number of call layers is still caught.

You can read more about how the plugin's taint analysis works and what vulnerabilities it detects in docs/security.md.

Custom checks

13 Laravel-aware checks on top of Psalm's built-in diagnostics, each with a docs page explaining what it detects and how to fix it:

• UndefinedModelRelation: a relation name in with(), load(), or whereHas() that resolves to no relationship on the model.
• UnknownModelAttribute: a typo'd key passed to create(), fill(), or update() that matches no known attribute.
• UnresolvableAppendedModelAttribute: an $appends entry with no backing accessor, which is a runtime BadMethodCallException on toArray().
• OctaneIncompatibleBinding: a singleton() closure that resolves a request-scoped service, auto-enabled when laravel/octane is installed.
• NoEnvOutsideConfig: env() called outside the config directory, where it returns null once the config is cached.

See docs/issues/index.md for the full catalog.

Adopting it on an existing codebase

The first run on an untouched project will report a lot. Fix the security findings first, then park the type issues in a baseline so only new code is checked. The noisier checks are opt-in and off by default, so nothing here depends on rewriting your codebase.

[!IMPORTANT] --set-baseline records every issue it sees, security findings included, and a baselined TaintedSql stops being reported. After generating the baseline, delete the <Tainted...> blocks from psalm-baseline.xml, otherwise the vulnerabilities you just found go quiet.

Full playbook, including the strictness ramp and how to turn down noise: docs/adoption.md.

Continuous integration

Writes a ready-to-commit .github/workflows/psalm.yml that runs the plugin on pull requests and on pushes to your default branch, and uploads security findings to GitHub Code Scanning. See docs/github-actions.md for what the generated workflow does and how to customize it.

Configuration

You can customize Psalm configuration using XML config and/or cli parameters.

For plugin configuration options, see docs/config.md.

Versions & Dependencies

Maintained versions:

See releases for more details about supported PHP, Laravel and Psalm versions.

Psalm-Laravel or Larastan?

Use both. They solve different problems:

• Larastan excels at Laravel-specific type rules: model-property validation, view-string checks, and 17+ custom rules.
• Psalm-Laravel in addition to type checks, it provides taint-based security analysis that PHPStan structurally cannot offer, plus deep type support for Request data, Eloquent attributes, scopes, attributes, etc.

The first three rows are from our own testing. The commercial rows summarize vendor documentation, so check their current tiers before relying on them.

Psalm and PHPStan use almost the same annotation syntax, so they work side by side without conflicts.

Contributing

There are contributing docs that may help you with contributions.