Before & after example
The package repository includes a small leaky application. It is a source-analysis example, not a hosted application or a replay runner.
Try it locally
Section titled “Try it locally”Clone the package repository and install its dependencies:
git clone https://github.com/goktugcy/worker-safety.gitcd worker-safetycomposer install
# Deliberately risky sourcephp bin/worker-safety scan examples/leaky-app/before
# The revised sourcephp bin/worker-safety scan examples/leaky-app/afterA nonzero exit status on the first command is expected when findings reach the configured failure threshold. Read the report rather than treating the exit code as an observed production failure.
What changes
Section titled “What changes”Compare static request context, singleton state and collection growth between the two directories. The revised PermissionCache includes an explicit WS008 suppression for its reviewed bounded-cache behavior: the scanner does not attempt to prove a general eviction policy.
What this does not demonstrate
Section titled “What this does not demonstrate”This example does not send HTTP requests or prove that every runtime leak is detected.
Request replay is no longer only a plan: worker-safety test is available since 1.2.0 and does exactly what such a regression case needs — a real persistent worker, the same worker serving both requests, and a concrete wrong value observed on the second one.