Supported Languages
Application Languages
Nullify reviews code in the languages below. Where a finding can be safely patched, Nullify drafts an autofix pull request for it; autofix eligibility depends on the specific finding and its context, not on the language.
C
Buffer and memory-safety issues with contextual call-tree analysis.
C++
Includes modern C++ (17/20) with templated sinks.
C#
ASP.NET MVC and API patterns.
Go
SQL injection, SSRF, auth bypass, and command injection.
Java
Spring/Spring Boot, Jakarta EE, and servlet stacks with dataflow reasoning.
JavaScript
Node.js backends, Express, Next.js, and browser contexts.
TypeScript
Shares the JavaScript analysis engine.
Kotlin
JVM and Android server-side use cases.
PHP
Laravel, Symfony, and raw PHP entry points with sink-driven reasoning.
Python
Django, Flask, FastAPI, and data pipelines with reachability checks.
Ruby
Rails and Sinatra patterns, including mass-assignment and CSRF.
Rust
Memory-safety, unsafe-block, and web-framework (Axum, Actix) analysis.
Scala
Play and Akka HTTP services.
Solidity
Smart-contract checks (reentrancy, access control, unchecked calls).
Apex
Salesforce Apex SOQL injection, CRUD/FLS, and sharing-violation analysis.
Swift
iOS and server-side Swift entry points with sink-driven reasoning.
Infrastructure & Build Definitions
Terraform (HCL)
Yes
AWS S3, IAM, VPC, EKS, and encryption policies with blast-radius analysis.
AWS CloudFormation (YAML/JSON)
Yes
Reviews stack defaults, logging, encryption, and network exposure controls.
Azure Bicep
Yes
Focus on AKS, public ingress, identity, and storage hardening.
Kubernetes Manifests
Yes
Detects run-as-root, privilege escalation, network policy drift, and missing telemetry.
Container build files
Yes
Covers Dockerfile/Containerfile hardening, multistage hygiene, and base image posture.
Infrastructure findings link back to cloud context collected through the AWS connector so teams immediately understand affected accounts and services.
Last updated