The story’s score and claims

Comments on No. 20 of 51 · Psalm · edition of Sunday 8 November 2026

Psalm 7 release: PHP security&static analysis software

Summary

Psalm 7, the PHP static analyzer, was released on November 2 by maintainer Daniil Gentili. Taint-based security analysis now runs by default in the same pass as type checking and dead code detection, and the project says it is up to 10x faster, though no benchmark is given. It adds NoSQL, LLM prompt and URL taint kinds, a Hack-style capabilities model replacing the old purity annotations, and graph-based dead code detection. Framework plugins load automatically, and the plugin API is versioned separately. Projects can opt out of taint analysis.

Comments

Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules