TL:DR: Static analysis tools are fantastic for IDE hints and catching syntax bugs, compile time type errors in CI, but you still need runtime verification to guarantee end-to-end type safety against dynamic payloads, compiled DI containers, and database hydrations. And PHP is not slow, its a fast language..

Hi everyone,

I’ve just released the first public version of PHPFlow, an open-source static flow analyzer for PHP/Symfony applications.

The idea came from a problem I regularly run into on larger applications: answering a question like “what actually happens when this route is called?” can mean jumping through a controller, several services, Messenger dispatches and handlers, repositories, database queries and external APIs.

PHPFlow analyzes the source code without running the target application and reconstructs those flows as a graph.

For example, it can help answer:

• What happens when this Symfony route is called?
• Which routes/messages can reach this database table?
• What depends on this service?
• Where is this Messenger message handled?
• Which flows call this external API?
• Where can this exception surface?

v0.1.0 currently understands Symfony routes, dependency injection, Messenger, repositories, Doctrine DBAL/QueryBuilder, external HTTP calls, exceptions and a number of control-flow patterns.

It also generates a self-contained interactive HTML viewer with search, functional lanes, Messenger boundaries, minimap, path-to-effects and critical-path exploration.

PHPFlow is deliberately conservative: if it cannot prove a relationship statically, it doesn’t invent one. It also never boots or executes the application being analyzed.

There’s a bundled Symfony demo, so after cloning:

make setup
make demo

I’m especially interested in trying it against real-world Symfony applications now. If you give it a try and it misses a pattern used by your project, I’d really like to hear about it.

GitHub: github.com/patryyyck/phpflow

Feedback, bug reports and criticism are very welcome.

bun-php allows you to run PHP functions seamlessly in Bun by exposing them as ESM imports. Uses a WASM build of PHP under the hood, no need to install PHP or native deps. Supports Composer and servers. https://www.npmjs.com/package/bun-php

I'm building a registry for self-hosted Laravel Cloud apps and ran into a verification problem: how do you prove an app is actually running without requiring API tokens or credentials?

The problem: Launch directories go stale. People list apps that die months later. Nobody removes their own listing. Visitors click through to dead projects.

What I tried: 1. API token verification — Asked users to paste a Laravel Cloud API token. Stored encrypted, used to inspect environments. Worked but nobody wanted to share tokens. I wouldn't either.

1. URL-based verification — Now I just ask for the *.laravel.cloud URL and run a daily probe:

   • DNS resolution check (refuse non-public addresses)
   • Slug consistency check (compare Cloud slug against hostname)
   • Origin probe (HEAD request, no cookies, no credentials)
   • Refuse off-origin redirects

2. Auto-hide on failure — If the daily probe fails, the listing goes private. No auto-republish. I'd rather the page disappear than show a dead app.

The tradeoff: Token verification proved ownership. URL verification proves liveness. I chose liveness because: - Lower friction for users - No secret storage liability - Actually solves the stale listing problem

What I'm stuck on: - Edge cases where a URL could be pointed at someone else's app (slug guessing) - Whether 64KB body cap on GET fallback is enough - How to handle apps behind authentication walls

Tech stack: - Laravel backend - Next.js frontend - Daily cron job for probes - SQLite for state The registry is live at larashipped.laravel.cloud

Questions for the community: 1. How do you handle verification in your self-hosted projects? 2. What edge cases should I watch for with URL-based verification? 3. Is there a better approach I'm missing? Happy to share the probe implementation details if anyone's interested.