Skip to content
Worker Safety

WS003 · Runtime environment mutation

Default severity: MEDIUM · Framework: Any

What it checks

Section titled “What it checks”

Detects changes to process environment, INI settings and environment-related superglobals. Some mutations outlive a request under persistent workers; request-superglobal behavior is runtime-dependent.

What to review

Section titled “What to review”
  • Read configuration instead of writing it: resolve values from a config object built at boot.
  • If a value has to differ per request, pass it through the request-scoped service that needs it.
  • When a temporary change is unavoidable, restore the previous value in a finally block.

Inspect this rule

Section titled “Inspect this rule”
Terminal window
vendor/bin/worker-safety rules WS003

Accepting a reviewed risk

Section titled “Accepting a reviewed risk”

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.