It's Psalm — see the section on security analysis here: https://psalm.dev/docs/security_analysis/