Issues

Look up sink methods by their configured name

nth-root/phpstan-security#55 · opened

on Nov 6, 2026

Order of sources in a finding isn't stable between runs

nth-root/phpstan-security#54 · opened

on Nov 6, 2026

Laravel: query builder methods called statically on models

nth-root/phpstan-security#53 · opened

on Nov 4, 2026

Secrets compared with `===` instead of `hash_equals()`

nth-root/phpstan-security#49 · opened

on Nov 3, 2026

Passwords hashed with fast hash functions

nth-root/phpstan-security#48 · opened

on Nov 3, 2026

Weak randomness used for tokens, passwords and other secrets

nth-root/phpstan-security#47 · opened

on Nov 3, 2026

Dangerous and debug function calls

nth-root/phpstan-security#46 · opened

on Nov 3, 2026

Symfony forms with CSRF protection disabled

nth-root/phpstan-security#45 · opened

on Nov 3, 2026

Laravel: mass assignment with `$guarded = []` or `Model::unguard()`

nth-root/phpstan-security#44 · opened

on Nov 3, 2026

Insecure PHP settings through `ini_set()`

nth-root/phpstan-security#43 · opened

on Nov 3, 2026

World-writable file permissions

nth-root/phpstan-security#42 · opened

on Nov 3, 2026

Hardcoded cryptographic keys

nth-root/phpstan-security#41 · opened

on Nov 3, 2026

Constant or empty IV in `openssl_encrypt()`

nth-root/phpstan-security#40 · opened

on Nov 3, 2026

Weak encryption: ECB mode or broken ciphers in `openssl_encrypt()`

nth-root/phpstan-security#39 · opened

on Nov 3, 2026

Cookies without `Secure`, `HttpOnly` or `SameSite`

nth-root/phpstan-security#38 · opened

on Nov 3, 2026

Disabled TLS certificate verification

nth-root/phpstan-security#37 · opened

on Nov 3, 2026

XXE: entity substitution or DTD loading in XML parsers

nth-root/phpstan-security#36 · opened

on Nov 3, 2026

`unserialize()` without `allowed_classes`

nth-root/phpstan-security#35 · opened

on Nov 3, 2026

Values stored in `$_SESSION` aren't followed

nth-root/phpstan-security#34 · opened

on Nov 3, 2026

· 0.4

String and array casts drop taint

nth-root/phpstan-security#33 · opened

on Nov 3, 2026

· 0.4

Follow taint through methods called on a tainted value

nth-root/phpstan-security#32 · opened

on Nov 3, 2026

2

Show where a tainted value comes from

nth-root/phpstan-security#31 · opened

on Nov 3, 2026

Add CWE IDs and remedies to findings

nth-root/phpstan-security#30 · opened

on Nov 3, 2026

Document the `parameters.taint` configuration

nth-root/phpstan-security#29 · opened

on Nov 3, 2026

`sanitizes` has no effect on user-defined functions

nth-root/phpstan-security#28 · opened

on Nov 3, 2026

Navigation Menu

Repository navigation

Issues

Look up sink methods by their configured name

Order of sources in a finding isn't stable between runs

Laravel: query builder methods called statically on models

Secrets compared with `===` instead of `hash_equals()`

Passwords hashed with fast hash functions

Weak randomness used for tokens, passwords and other secrets

Dangerous and debug function calls

Symfony forms with CSRF protection disabled

Laravel: mass assignment with `$guarded = []` or `Model::unguard()`

Insecure PHP settings through `ini_set()`

World-writable file permissions

Hardcoded cryptographic keys

Constant or empty IV in `openssl_encrypt()`

Weak encryption: ECB mode or broken ciphers in `openssl_encrypt()`

Cookies without `Secure`, `HttpOnly` or `SameSite`

Disabled TLS certificate verification

XXE: entity substitution or DTD loading in XML parsers

`unserialize()` without `allowed_classes`

Values stored in `$_SESSION` aren't followed

String and array casts drop taint

Follow taint through methods called on a tainted value

Show where a tainted value comes from

Add CWE IDs and remedies to findings

Document the `parameters.taint` configuration

`sanitizes` has no effect on user-defined functions