> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/code-analysis/supported-languages.md).

# Supported Languages

## Application Languages

Nullify reviews code in the languages below. Where a finding can be safely patched, Nullify drafts an [autofix](/capabilities/remediations.md) pull request for it; autofix eligibility depends on the specific finding and its context, not on the language.

| Language   | Coverage Highlights                                                         |
| ---------- | --------------------------------------------------------------------------- |
| C          | Buffer and memory-safety issues with contextual call-tree analysis.         |
| C++        | Includes modern C++ (17/20) with templated sinks.                           |
| C#         | ASP.NET MVC and API patterns.                                               |
| Go         | SQL injection, SSRF, auth bypass, and command injection.                    |
| Java       | Spring/Spring Boot, Jakarta EE, and servlet stacks with dataflow reasoning. |
| JavaScript | Node.js backends, Express, Next.js, and browser contexts.                   |
| TypeScript | Shares the JavaScript analysis engine.                                      |
| Kotlin     | JVM and Android server-side use cases.                                      |
| PHP        | Laravel, Symfony, and raw PHP entry points with sink-driven reasoning.      |
| Python     | Django, Flask, FastAPI, and data pipelines with reachability checks.        |
| Ruby       | Rails and Sinatra patterns, including mass-assignment and CSRF.             |
| Rust       | Memory-safety, unsafe-block, and web-framework (Axum, Actix) analysis.      |
| Scala      | Play and Akka HTTP services.                                                |
| Solidity   | Smart-contract checks (reentrancy, access control, unchecked calls).        |
| Apex       | Salesforce Apex SOQL injection, CRUD/FLS, and sharing-violation analysis.   |
| Swift      | iOS and server-side Swift entry points with sink-driven reasoning.          |

## Infrastructure & Build Definitions

| Format                         | Assessment Coverage | Notes                                                                                      |
| ------------------------------ | ------------------- | ------------------------------------------------------------------------------------------ |
| Terraform (HCL)                | Yes                 | AWS S3, IAM, VPC, EKS, and encryption policies with blast-radius analysis.                 |
| AWS CloudFormation (YAML/JSON) | Yes                 | Reviews stack defaults, logging, encryption, and network exposure controls.                |
| Azure Bicep                    | Yes                 | Focus on AKS, public ingress, identity, and storage hardening.                             |
| Kubernetes Manifests           | Yes                 | Detects run-as-root, privilege escalation, network policy drift, and missing telemetry.    |
| Container build files          | Yes                 | Covers `Dockerfile`/`Containerfile` hardening, multistage hygiene, and base image posture. |

Infrastructure findings link back to cloud context collected through the AWS connector so teams immediately understand affected accounts and services.