Introduction

Under PHP-FPM, every request gets a fresh PHP context. The OS worker process is reused, but the engine tears the request down afterwards, so anything you left in a static property, a global or a singleton is gone by the next request. This is therefore harmless:

final class UserContext
{
    public static ?User $user = null;
}

Under FrankenPHP worker mode, Laravel Octane, RoadRunner or Swoole the process stays alive and serves request after request. The same code now means: the user from the previous request is still there. Depending on what reads it, that is a stale cache, a wrong audit log, or one customer seeing another customer’s data.

These bugs are hard to find by testing, because they only appear on the second request, and only when two requests differ in the right way.

Worker Safety reads your source code and points at the places where this can happen — before you flip the switch.

What Worker Safety does

Worker Safety analyzes PHP source code. It does not measure production RSS or reset application state. Use it to review worker compatibility before migration and to check changes in CI.

Replaying HTTP requests is a separate, complementary question — whether a later request did observe what an earlier one wrote. That is runtime replay, available since 1.2.0 alongside source analysis.

Install and run your first scan →