Follow shared state
Inspect static properties, globals and mutable singletons. Cross-file indexing connects Laravel bindings to the classes they share.
New request. Old state?
Find the state your PHP application carries into the next request. Scan before you move to persistent workers — and keep checking in CI.
Analysis targetsFrankenPHPLaravel OctaneRoadRunnerSwoole
Catch risks before the next request
Section titled “Catch risks before the next request”Understand each finding
Ten focused rules explain the risk, its location and what to review. Severity describes an analysis finding, not a confirmed production incident.
Make CI actionable
Choose a failure threshold, adopt a baseline and export SARIF to GitHub code scanning. Review accepted risks without losing the whole report.
Use your workflow
Run the standalone CLI or the Laravel Artisan command. The same analysis engine, options and output formats power both.
From install to insight
Section titled “From install to insight”-
Install as a development dependency.
Terminal window composer require --dev goktugcy/worker-safety -
Scan the application. No configuration file is required.
Terminal window vendor/bin/worker-safety scan# In Laravel:php artisan worker-safety:scan -
Review the result. Start with the reported location, check the value’s lifetime and decide whether to fix or document the risk.
A risk analyzer, with clear boundaries.
A clean scan is not proof of worker safety. Runtime targets are selected, not detected, and Worker Safety does not monitor production memory. Since 1.2.0, runtime replay complements source analysis by sending HTTP requests to a running single-worker instance and observing whether one request can see another’s state.