Stop shipping var_dump() to production — enforce it with PHPStan

Source: Dev.to

The problem

PHPStan is great — but enforcing custom rules like this is not trivial.

You either:

• write a custom PHPStan rule (time‑consuming)
• or use something limited like banned functions

What I wanted

I needed something that could:

• ban specific functions (var_dump, dd)
• restrict certain method calls
• enforce architecture boundaries
• be configurable without writing PHP code

The solution

I built a small PHPStan extension that lets you define forbidden patterns:

parameters:
  forbidden_node:
    nodes:
      - type: Expr_FuncCall
        functions: [var_dump, dd]

Now PHPStan reports:

Forbidden function var_dump() used in App\Service\UserService.php:42

Why this is useful

You can enforce rules like:

• ❌ no debug functions in production
• ❌ no direct DB calls in controllers
• ❌ no cross‑layer violations
• ❌ no unsafe patterns

Repo

👉