Configuration

Worker Safety runs without any configuration. To customise it, put a worker-safety.yaml in the project root (worker-safety.yml, worker-safety.dist.yaml and .worker-safety.yaml are also picked up), or pass --config=path/to/file.yaml.

paths:
  - app
  - src

exclude:
  - vendor
  - storage
  - tests

runtime:
  - frankenphp
  - octane

rules:
  WS001:
    enabled: true
    severity: high

  # Shorthand for `enabled: false`
  WS009: false

# Suppress a rule for specific paths
ignore:
  WS008:
    - app/Legacy

fail_on: high

# Fail the scan when a file cannot be analyzed at all (default: true).
fail_on_parse_error: true

baseline: worker-safety-baseline.json

See worker-safety.example.yaml for the annotated version — it is the exact file init writes.

Notes:

• Unknown keys, unknown rule ids and invalid severities are hard errors (exit code 2), not silently ignored typos.
• exclude patterns: a bare name (vendor) matches any path segment, a value containing / (bootstrap/cache) matches a path prefix, and globs (*.blade.php) match the path and the basename.
• vendor, node_modules and .git are always excluded, even if you replace the exclude list, unless you explicitly point a scan path inside them.
• A configured severity always wins over the severity a rule computed.

Default scan paths

With no paths configured and no path argument, Worker Safety uses the framework defaults — Laravel: app, bootstrap, config, database, routes; Symfony: src, config; otherwise src, lib, app — skipping the ones that do not exist, and falling back to the project root.