Psalm is a static analysis tool for finding errors and security vulnerabilities in PHP applications.
Psalm catches bugs, type mismatches, and security issues by analyzing PHP code without executing it. The tool performs type inference across codebases to identify problems that would otherwise surface only at runtime or in production. It includes taint analysis capabilities for tracking potentially unsafe data flows through applications, helping developers spot security vulnerabilities before deployment.
Psalm suits teams building PHP applications where code quality and security matter. It works well integrated into development workflows and continuous integration pipelines. The tool is particularly valuable for large codebases where manual review becomes impractical, and for projects where security vulnerabilities carry high risk. Developers should expect to configure Psalm for their specific codebase, as the tool provides configuration options to tune analysis strictness and suppress false positives where needed.
The project maintains active engagement with its user base. Almost all open issues come from outside users rather than the core team, reflecting a substantial base of adopters relying on the tool in production. Maintainers typically respond to new issues and pull requests within a day. Work in the issue tracker centers on bug fixes, enhancements, and template improvements, showing a focus on stability and usability rather than experimental features.
