Page tree
Skip to end of metadata
Go to start of metadata

Extension ID

What's new?

See Psalm Security Rules - 1.0 - Release Notes for more information.


This extension provides a dedicated set of quality rules that have been designed to check your PHP source code for user input security defects or violations. These quality rules are based on the user input security checks provided by the open source static analysis tool called Psalm (see and are in addition to the PHP quality rules provided by the PHP Analyzer. The PHP Analyzer is a dependent extension and the Psalm Security Rules extension will run its quality rules against the results of the PHP Analyzer analysis.

The following Psalm user input security checks are supported by this extension:

A detailed explanation of the security checks provided by Psalm can be seen in with a dedicated section about avoiding false-positives

In what situation should you install this extension?

If you are analyzing PHP source code and would like to check this code for user input security violations and view the results in the CAST Engineering Dashboard, you should install this extension.

Function Point, Quality and Sizing support

This extension provides the following support:

  • Function Points (transactions): a green tick indicates that OMG Function Point counting and Transaction Risk Index are supported
  • Quality and Sizing: a green tick indicates that CAST can measure size and that a minimum set of Quality Rules exist
Function Points
Quality and Sizing(tick)

AIP Core compatibility

This extension is compatible with:

AIP Core releaseSupported

Supported DBMS servers used for AIP Core schemas

This extension is compatible with the following DBMS servers used to host AIP Core schemas:

AIP Core releaseCSS/PostgreSQL
All supported releases(tick)

Dependencies with other extensions

Note that when using CAST Console to download and install the extension, any dependent extensions are automatically downloaded and installed.

Download and installation instructions

The extension will not be automatically downloaded and installed in CAST Console. If you need to use it, should manually install the extension using the Application - Extensions interface:

What analysis results can you expect?

Structural rules

  • No labels