Supported Languages
Primary Languages (Deep Coverage)
| Language | Rules | Frameworks Supported | Coverage |
|---|---|---|---|
| Python | 334 | Django, Flask, FastAPI, Pyramid | OWASP Top 10, CWE Top 25 |
| Terraform | 362 | AWS, Azure, GCP, Kubernetes | Infrastructure security |
| JavaScript | 173 | React, Vue, Angular, Express, Node.js | Frontend & backend |
| Java | 121 | Spring, Jakarta EE, Struts, Play | Enterprise applications |
| TypeScript | 30 | React, Angular, Next.js, NestJS | Modern web apps |
| Go | 76 | Gin, Echo, Fiber, standard library | Cloud-native apps |
| Ruby | 92 | Rails, Sinatra, Grape | Web applications |
| PHP | 61 | Laravel, Symfony, WordPress, Drupal | CMS and web apps |
| C# | 51 | ASP.NET, .NET Core, Entity Framework | Windows & cross-platform |
Additional Languages
| Language | Rules | Use Cases |
|---|---|---|
| YAML/Kubernetes | 120 | K8s manifests, Helm charts, docker-compose |
| Scala | 27 | Play Framework, Akka, Spark |
| Solidity | 50 | Smart contracts, DeFi, blockchain |
| Kotlin | 14 | Android, Spring Boot, server-side |
| Rust | 10 | Systems programming, web services |
| Swift | 4 | iOS, macOS applications |
| Elixir | 7 | Phoenix Framework |
| OCaml | 23 | Functional programming |
| Bash/Shell | 6 | Scripts, DevOps automation |
| C/C++ | 16 | Systems programming |
| Apex | 18 | Salesforce development |
| Clojure | 5 | JVM functional programming |
| Dockerfile | 35 | Container security |
| HTML | 6 | Template security |
| JSON | 4 | Configuration security |
Generic Rules
37 problem-based rules that work across all languages:- Hardcoded secrets
- Insecure random number generation
- Weak cryptography
- Insecure deserialization
- And more
Framework-Specific Detection
Web Frameworks
Python:- Django ORM injection detection
- Flask template injection
- FastAPI security misconfigurations
- Pyramid authorization flaws
- React XSS and dangerouslySetInnerHTML
- Vue.js template injection
- Express.js route security
- Next.js API route vulnerabilities
- Spring Security misconfigurations
- Hibernate/JPA injection
- Jakarta EE authentication flaws
- Struts OGNL injection
- Rails mass assignment
- ActiveRecord SQL injection
- Sinatra route security
- Rails CSRF bypass
- Laravel query injection
- Symfony security component misuse
- WordPress plugin vulnerabilities
- Drupal access control
- Gin parameter injection
- Echo template rendering
- Standard library SQL issues
- Goroutine race conditions
Mobile Frameworks
iOS (Swift):- KeyChain misuse
- Insecure data storage
- SSL pinning issues
- Intent injection
- WebView security
- SharedPreferences exposure
Vulnerability Categories
OWASP Top 10 (2021) Coverage
| OWASP 2021 Category | Detection | Rule Count | Examples |
|---|---|---|---|
| A01: Broken Access Control | ✅ Full | 100+ | Missing authorization, IDOR, path traversal, privilege escalation |
| A02: Cryptographic Failures | ✅ Full | 80+ | MD5/SHA1 usage, weak crypto, hardcoded secrets, insecure random |
| A03: Injection | ✅ Full | 400+ | SQL, NoSQL, Command, LDAP, XPath, XML, OS command injection |
| A04: Insecure Design | ✅ Partial | 50+ | Missing rate limiting, trust boundary violations, security anti-patterns |
| A05: Security Misconfiguration | ✅ Full | 150+ | Debug enabled, defaults, CORS, headers, verbose errors |
| A06: Vulnerable Components | ⚠️ SCA Tool | - | Use Trivy SCA for dependency vulnerabilities |
| A07: Auth/Session Failures | ✅ Full | 90+ | Broken auth, session fixation, weak passwords, missing MFA |
| A08: Data Integrity Failures | ✅ Full | 70+ | Insecure deserialization (Pickle, YAML, JSON), unsigned JWTs |
| A09: Logging Failures | ✅ Partial | 30+ | Credentials in logs, insufficient logging, sensitive data exposure |
| A10: SSRF | ✅ Full | 40+ | Server-side request forgery, unsafe URL construction |
CWE Top 25 Coverage
CodeThreat detects CWE Top 25 (2021 & 2022) most dangerous software weaknesses: ✅ Complete coverage of CWE Top 25 including: Injection (CWE-74):- CWE-89: SQL Injection
- CWE-78: OS Command Injection
- CWE-79: Cross-Site Scripting
- CWE-91: XML Injection
- CWE-943: NoSQL Injection
- CWE-327: Broken/Risky Crypto
- CWE-328: Weak Hash
- CWE-330: Weak Random
- CWE-331: Insufficient Entropy
- CWE-326: Inadequate Encryption
- CWE-287: Improper Authentication
- CWE-306: Missing Authentication
- CWE-307: Improper Restriction of Excessive Authentication Attempts
- CWE-798: Use of Hard-coded Credentials
- CWE-285: Improper Authorization
- CWE-862: Missing Authorization
- CWE-863: Incorrect Authorization
- CWE-79: Cross-Site Scripting
- CWE-22: Path Traversal
- CWE-416: Use After Free
- CWE-434: Unrestricted Upload
- CWE-352: CSRF
- CWE-601: Open Redirect
- And 100+ more CWE categories
Language-Specific Vulnerabilities
Python-Specific
✅ Django template injection✅ Pickle deserialization
✅ Eval/exec code execution
✅ YAML unsafe load
✅ Flask Jinja2 SSTI
✅ SQLAlchemy injection
✅ subprocess shell injection
JavaScript/TypeScript-Specific
✅ Prototype pollution✅ RegExp DoS
✅
eval() and Function() usage✅
innerHTML XSS✅ Express route parameter injection
✅ JWT algorithm confusion
✅ Path traversal
Java-Specific
✅ Deserialization of untrusted data✅ JNDI injection (Log4Shell-style)
✅ Spring SpEL injection
✅ XML External Entity (XXE)
✅ JDBC SQL injection
✅ Reflection abuse
Go-Specific
✅ SQL injection in database/sql✅ Command injection in exec.Command
✅ Path traversal
✅ Unsafe reflection
✅ Race conditions
Infrastructure as Code
Terraform (362 rules): ✅ Public S3 buckets✅ Unencrypted storage
✅ Overly permissive IAM
✅ Missing security groups
✅ Insecure network configs Kubernetes/YAML (120 rules): ✅ Privileged containers
✅ Host network access
✅ Missing resource limits
✅ Insecure volume mounts
✅ Exposed secrets Dockerfile (35 rules): ✅ Running as root
✅ Vulnerable base images
✅ Exposed secrets
✅ Missing health checks
Blockchain/Smart Contracts
Solidity (50 rules): ✅ Reentrancy vulnerabilities✅ Integer overflow/underflow
✅ Unchecked external calls
✅ Access control issues
✅ Gas optimization
Compliance and Standards
OWASP Top 10 (2021): Full coverage of all 10 categories with 1,000+ relevant rules CWE Top 25: Complete coverage of most dangerous weaknesses (2021 & 2022 lists) SANS Top 25: Aligned with SANS/CWE Most Dangerous Software Errors Rules are tagged with compliance standards for easy filtering and reporting.While CodeThreat doesn’t have specific PCI-DSS or HIPAA rule sets, our OWASP Top 10 and CWE coverage addresses the security requirements mandated by these compliance frameworks.