Psalm project (originated at Vimeo)

Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.