diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
new file mode 100644
index 0000000..e567581
--- /dev/null
+++ b/.github/workflows/pull-request.yml
@@ -0,0 +1,18 @@
+name: PR checks
+
+on:
+  pull_request:
+    types: [ opened, synchronize ]
+
+jobs:
+  lint-plugin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Install composer dependencies
+        run: composer install
+
+      - name: Run phpcs
+        run: ./vendor/bin/phpcs
diff --git a/src/Http/Handlers/AuthorizeHandler.php b/src/Http/Handlers/AuthorizeHandler.php
index fd23b5b..473db07 100644
--- a/src/Http/Handlers/AuthorizeHandler.php
+++ b/src/Http/Handlers/AuthorizeHandler.php
@@ -1,5 +1,7 @@
 <?php
 
+// phpcs:disable WordPress.Security.NonceVerification.Missing
+
 namespace OpenIDConnectServer\Http\Handlers;
 
 use OAuth2\Request;
diff --git a/src/Http/Router.php b/src/Http/Router.php
index 6c5eccd..1667ec3 100644
--- a/src/Http/Router.php
+++ b/src/Http/Router.php
@@ -56,14 +56,14 @@ function () use ( $route, $methods ) {
 		);
 	}
 
-	private function get_current_route() {
+	private function get_current_route(): string {
 		$wp_url        = get_site_url();
-		$installed_dir = parse_url( $wp_url, PHP_URL_PATH );
+		$installed_dir = wp_parse_url( $wp_url, PHP_URL_PATH );
 
-		// requested uri relative to WP install
-		$request_uri = str_replace( $installed_dir, '', $_SERVER['REQUEST_URI'] );
+		// Requested URI relative to WP install.
+		$uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+		$uri = str_replace( $installed_dir, '', $uri );
 
-		$uri   = sanitize_text_field( wp_unslash( $request_uri ) );
 		$route = strtok( $uri, '?' );
 
 		return trim( $route, '/' );
diff --git a/src/Storage/UserClaimsStorage.php b/src/Storage/UserClaimsStorage.php
index 9c2cb36..1380236 100644
--- a/src/Storage/UserClaimsStorage.php
+++ b/src/Storage/UserClaimsStorage.php
@@ -1,5 +1,7 @@
 <?php
 
+//phpcs:disable WordPress.Security.NonceVerification.Recommended
+
 namespace OpenIDConnectServer\Storage;
 
 use OAuth2\OpenID\Storage\UserClaimsInterface;