> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/code-analysis/supported-languages.md).

# Supported Languages

## Application Languages

Nullify reviews code in the languages below. Where a finding can be safely patched, Nullify drafts an [autofix](/capabilities/remediations.md) pull request for it; autofix eligibility depends on the specific finding and its context, not on the language.

| Language   | Coverage Highlights                                                                |
| ---------- | ---------------------------------------------------------------------------------- |
| C          | Buffer and memory-safety issues with contextual call-tree analysis.                |
| C++        | Includes modern C++ (17/20) with templated sinks.                                  |
| C#         | ASP.NET MVC and API patterns.                                                      |
| Go         | SQL injection, SSRF, auth bypass, and command injection.                           |
| Java       | Spring/Spring Boot, Jakarta EE, and servlet stacks with dataflow reasoning.        |
| JavaScript | Node.js backends, Express, Next.js, and browser contexts.                          |
| TypeScript | Shares the JavaScript analysis engine.                                             |
| Kotlin     | JVM and Android server-side use cases.                                             |
| PHP        | Laravel, Symfony, and raw PHP entry points with sink-driven reasoning.             |
| Python     | Django, Flask, FastAPI, and data pipelines with reachability checks.               |
| Ruby       | Rails and Sinatra patterns, including mass-assignment and CSRF.                    |
| Rust       | Memory-safety, unsafe-block, and web-framework (Axum, Actix) analysis.             |
| Scala      | Play and Akka HTTP services.                                                       |
| Solidity   | Smart-contract checks (reentrancy, access control, unchecked calls).               |
| Bash       | Shell-command construction and unsafe scripting patterns.                          |
| Clojure    | Dedicated rules for supported Clojure patterns.                                    |
| OCaml      | Dedicated rules for supported OCaml patterns.                                      |
| HTML       | Browser and template security patterns, including embedded client-side JavaScript. |
| Apex       | Salesforce Apex SOQL injection, CRUD/FLS, and sharing-violation analysis.          |
| Swift      | iOS and server-side Swift entry points with sink-driven reasoning.                 |

## Infrastructure & Build Definitions

| Format                         | Assessment Coverage | Notes                                                                                      |
| ------------------------------ | ------------------- | ------------------------------------------------------------------------------------------ |
| Terraform (HCL)                | Yes                 | AWS S3, IAM, VPC, EKS, and encryption policies with blast-radius analysis.                 |
| AWS CloudFormation (YAML/JSON) | Yes                 | Reviews stack defaults, logging, encryption, and network exposure controls.                |
| Terraform (Azure)              | Yes                 | Focus on AKS, public ingress, identity, and storage hardening.                             |
| Kubernetes Manifests           | Yes                 | Detects run-as-root, privilege escalation, network policy drift, and missing telemetry.    |
| Container build files          | Yes                 | Covers `Dockerfile`/`Containerfile` hardening, multistage hygiene, and base image posture. |

Infrastructure findings link back to cloud context collected through the AWS connector so teams immediately understand affected accounts and services.

## Additional configuration coverage

| Format              | Scope                                                                    |
| ------------------- | ------------------------------------------------------------------------ |
| Terraform for GCP   | Google Cloud resource configuration, IAM, storage, and network controls. |
| GitHub Actions YAML | Workflow permissions, untrusted inputs, and unsafe execution patterns.   |
| Ansible YAML        | Security-sensitive automation and configuration.                         |
| Docker Compose YAML | Container privileges and service configuration.                          |
| OpenAPI YAML        | Security-relevant API specification patterns.                            |
| AWS IAM JSON        | Standalone IAM policy checks.                                            |
| Snowflake SQL       | Narrow SQL masking-policy checks through generic rules.                  |

Coverage is rule- and framework-specific. A supported file format does not imply every feature of that language or cloud service is analyzed. Azure infrastructure coverage here is Terraform, not a dedicated Bicep ruleset. Runtime cloud posture is covered separately by [Cloud Audits](/capabilities/cloud-audits.md).