WS007 · Static request/user context

Default severity: HIGH · Framework: Any

Severity is contextual

This is the default severity, not a guarantee for every finding. The implementation and configured overrides determine the reported severity. Runtime targets describe a compatibility analysis, not a detected deployment.

What it checks

State that identifies the current user, request, session or tenant belongs to a single request. Held in a static property or a function-scoped static, it becomes the identity that the next request sees.

What to review

• Resolve the value from the current request instead of caching it statically.
• Inject a request-scoped context object (Laravel: a scoped() binding) into the classes that need it.
• If the static slot must stay, clear it in a terminating middleware or a worker request-lifecycle hook.

Inspect this rule

vendor/bin/worker-safety rules WS007

Accepting a reviewed risk

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.