What is this?
Psalm is a static analysis tool that scans PHP code to find errors and security vulnerabilities without running the application.
Psalm is a static analysis tool that scans PHP code to find errors and security vulnerabilities without running the application.Is it a library I import, or a tool I run?It's a tool you run against your PHP project, not code you import into the app.
It's a tool you run against your PHP project, not code you import into the app.How do I get it running?The README doesn't list commands. It points to an installation guide on Psalm's website, and there is also a live demo there if you want to try it first.
The README doesn't list commands. It points to an installation guide on Psalm's website, and there is also a live demo there if you want to try it first.What do I need on my side first?The README lists no requirements. Psalm targets PHP applications, so you need a PHP codebase to analyze. Check the installation guide for the exact environment.
The README lists no requirements. Psalm targets PHP applications, so you need a PHP codebase to analyze. Check the installation guide for the exact environment.What does type inference do in Psalm?Psalm works out the types of variables and return values from the code itself, so it can flag mismatched values even where you did not write explicit type hints.
Psalm works out the types of variables and return values from the code itself, so it can flag mismatched values even where you did not write explicit type hints.What is taint analysis?It follows untrusted input, such as user data, from where it enters the app to where it is used, and warns when that data reaches a dangerous spot like a database query without proper handling.
It follows untrusted input, such as user data, from where it enters the app to where it is used, and warns when that data reaches a dangerous spot like a database query without proper handling.Does it run on Windows and macOS too?The README does not list supported operating systems. As a PHP command-line tool it generally runs wherever PHP runs, but check the installation guide to confirm.
The README does not list supported operating systems. As a PHP command-line tool it generally runs wherever PHP runs, but check the installation guide to confirm.What are similar projects?rector, static-analysis, mypy, php2shell-checker, PHP-Parser, infer, shellcheck, phpstan
rector, static-analysis, mypy, php2shell-checker, PHP-Parser, infer, shellcheck, phpstanWhich topics is it in?php-security, type-inference, vulnerability-detection, static-code-analysis, code-analysis, vulnerability-scanner, code-quality, static-analysis, php, security-tools, developers, hacktoberfest
php-security, type-inference, vulnerability-detection, static-code-analysis, code-analysis, vulnerability-scanner, code-quality, static-analysis, php, security-tools, developers, hacktoberfest