Skip to content
Worker Safety

WS002 · Mutable global variable

Default severity: HIGH · Framework: Any

What it checks

Section titled “What it checks”

Detects global declarations and writes to $GLOBALS or superglobals. Process-wide state can be shared between requests; the persistence of request superglobals depends on the selected runtime. Read the finding-level severity and lifecycle details.

What to review

Section titled “What to review”
  • Pass the value explicitly, or resolve it from a request-scoped service.
  • If a process-wide value is genuinely needed, expose it through an immutable object built once at boot.
  • Never write application state into $GLOBALS or into the request superglobals.

Inspect this rule

Section titled “Inspect this rule”
Terminal window
vendor/bin/worker-safety rules WS002

Accepting a reviewed risk

Section titled “Accepting a reviewed risk”

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.