Psalm

Visit Website

Introduction

Psalm is a static analysis tool for finding errors and security vulnerabilities in PHP applications. It was created at Vimeo and focuses on type inference and soundness.

Besides type checking, Psalm offers taint analysis that tracks user-controlled input to dangerous sinks, detecting SQL injection, XSS and similar issues. Error levels, baselines and suppression annotations support adoption on existing code, and Psalter can automatically fix some issues such as adding missing types.

In the quality loop Psalm covers both correctness and security for PHP.

The source code is at vimeo/psalm on GitHub under the MIT licence, with about 5,900 stars; the most recent commit was on 11 November 2026.

Features

1. Type inference: Detects type errors and dead code.
2. Taint analysis: Finds injection vulnerabilities.
3. Psalter: Automatic code fixes.
4. Baselines: Gradual adoption.
5. Plugins: Framework support.
6. Error levels: Configurable strictness.

Pros

1. Security focus: Taint analysis is built in.
2. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 5,900 GitHub stars.

Cons

1. Overlap with PHPStan: Many teams choose one.
2. Annotations: Best results need PHPDoc.
3. Smaller plugin ecosystem: Fewer framework plugins than PHPStan.

Usage and Links (Example)

composer require --dev vimeo/psalm
vendor/bin/psalm --init
vendor/bin/psalm --taint-analysis

Resources:

• Psalm website
• GitHub repository

Pricing

Psalm is free and open source under the MIT licence.

Recommended for?

1. PHP teams that want taint analysis.
2. Security-sensitive PHP applications.

Conclusion

Psalm combines strong type checking with built-in taint analysis for PHP.

Run its taint mode on any application that handles untrusted input.

On CheckOps, Psalm is filed under the Release & CI gates and Security testing stages. Related tools listed here include PHPStan, PHPUnit, Infection, SonarQube, Semgrep and Pest. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.