HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
vimeo
psalm
PHP2017–2025
vimeo / psalm

psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

6Distinct people
8Mentions
0Explicit recommenders
5.9KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year8 dated mentions

Observed mentions: 2017-09-18 21:15:40 UTC to 2025-09-13 20:32:22 UTC.

01232017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC101
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC303
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC101
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101

What Hacker News says

8 sources
I'll assume you meant Mago instead of Mayo. Why do you feel the need to personally discredit me instead of sticking to constructive arguments? And where did I say Mago wasn't a static analysis tool? I'm glad you wrote Psalm. However I and most of the PHP community use https://phpstan.org instead, as you may know. At the time I made this choice on technical grounds. Then PHPStan found a way to stay profitable with PHPStan Pro while Psalm stagnated, which cemented my decision. Recently, vimeo being acquired by Bending Spoons doesn't help either since psalm still lives in https://github.com/vimeo/psalm
In Mago: A fast PHP toolchain written in Rust
Here's "git shortlog -sne", with Stripe employees (current and former) and email addresses removed. I've annotated with current company, if easily-discoverable: https://gist.github.com/muglug/a70b7316f92d05f9febbf56684a8e... That list is a minority of all 166 in the original (and there may still be some Stripe accounts there). Additionally all of the top 10 are current or former Stripe employees, and at least 96% of all commits come from current or former Stripe employees. BUT there's also nothing wrong with this – in a similar project I created (https://github.com/vimeo/psalm), 90% of the commits come from employees at Vimeo. I was just pointing out it's good.
In Why the Sorbet type checker is fast
Give C# a go. I'm a full-time PHP programmer, and C# has a lot of great things that PHP probably never will. > Nothing of remote interest is happening in PHP land for me. Nobody can make you interested in anything you don't want to be, but I'm trying to solve a bunch of non-trivial issues here: https://github.com/vimeo/psalm/issues
In P++ idea: FAQ
I think that the biggest win with this feature, is not that PHP will do more runtime type checks, but that the syntax is valid. The past years we've seen several static analysers become more and more popular in the PHP community. Tools like phpstan (https://github.com/phpstan/phpstan) and psalm by Vimeo (https://github.com/vimeo/psalm). Allowing this syntax is a great way to write cleaner code that can be statically analysed, which is far more superior than the runtime type checker.
In Typed Properties in PHP 7.4

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.