Supported Languages
Primary Languages (Deep Coverage)
| Language | Rules | Frameworks Supported | Coverage |
|---|---|---|---|
| Python | 334 | Django, Flask, FastAPI, Pyramid | OWASP Top 10, CWE Top 25 |
| Terraform | 362 | AWS, Azure, GCP, Kubernetes | Infrastructure security |
| JavaScript | 173 | React, Vue, Angular, Express, Node.js | Frontend & backend |
| Java | 121 | Spring, Jakarta EE, Struts, Play | Enterprise applications |
| TypeScript | 30 | React, Angular, Next.js, NestJS | Modern web apps |
| Go | 76 | Gin, Echo, Fiber, standard library | Cloud-native apps |
| Ruby | 92 | Rails, Sinatra, Grape | Web applications |
| PHP | 61 | Laravel, Symfony, WordPress, Drupal | CMS and web apps |
| C# | 51 | ASP.NET, .NET Core, Entity Framework | Windows & cross-platform |
Additional Languages
| Language | Rules | Use Cases |
|---|---|---|
| YAML/Kubernetes | 120 | K8s manifests, Helm charts, docker-compose |
| Scala | 27 | Play Framework, Akka, Spark |
| Solidity | 50 | Smart contracts, DeFi, blockchain |
| Kotlin | 14 | Android, Spring Boot, server-side |
| Rust | 10 | Systems programming, web services |
| Swift | 4 | iOS, macOS applications |
| Elixir | 7 | Phoenix Framework |
| OCaml | 23 | Functional programming |
| Bash/Shell | 6 | Scripts, DevOps automation |
| C/C++ | 16 | Systems programming |
| Apex | 18 | Salesforce development |
| Clojure | 5 | JVM functional programming |
| Dockerfile | 35 | Container security |
| HTML | 6 | Template security |
| JSON | 4 | Configuration security |
Generic Rules
37 problem-based rules that work across all languages:- Hardcoded secrets
- Insecure random number generation
- Weak cryptography
- Insecure deserialization
- And more
Framework-Specific Detection
Web Frameworks
Python:- Django ORM injection detection
- Flask template injection
- FastAPI security misconfigurations
- Pyramid authorization flaws
- React XSS and dangerouslySetInnerHTML
- Vue.js template injection
- Express.js route security
- Next.js API route vulnerabilities
- Spring Security misconfigurations
- Hibernate/JPA injection
- Jakarta EE authentication flaws
- Struts OGNL injection
- Rails mass assignment
- ActiveRecord SQL injection
- Sinatra route security
- Rails CSRF bypass
- Laravel query injection
- Symfony security component misuse
- WordPress plugin vulnerabilities
- Drupal access control
- Gin parameter injection
- Echo template rendering
- Standard library SQL issues
- Goroutine race conditions
Mobile Frameworks
iOS (Swift):- KeyChain misuse
- Insecure data storage
- SSL pinning issues
- Intent injection
- WebView security
- SharedPreferences exposure
Vulnerability Categories
OWASP Top 10 (2021) Coverage
| OWASP 2021 Category | Detection | Rule Count | Examples |
|---|---|---|---|
| A01: Broken Access Control | ✅ Full | 100+ | Missing authorization, IDOR, path traversal, privilege escalation |
| A02: Cryptographic Failures | ✅ Full | 80+ | MD5/SHA1 usage, weak crypto, hardcoded secrets, insecure random |
| A03: Injection | ✅ Full | 400+ | SQL, NoSQL, Command, LDAP, XPath, XML, OS command injection |
| A04: Insecure Design | ✅ Partial | 50+ | Missing rate limiting, trust boundary violations, security anti-patterns |
| A05: Security Misconfiguration | ✅ Full | 150+ | Debug enabled, defaults, CORS, headers, verbose errors |
| A06: Vulnerable Components | ⚠️ SCA Tool | - | Use Trivy SCA for dependency vulnerabilities |
| A07: Auth/Session Failures | ✅ Full | 90+ | Broken auth, session fixation, weak passwords, missing MFA |
| A08: Data Integrity Failures | ✅ Full | 70+ | Insecure deserialization (Pickle, YAML, JSON), unsigned JWTs |
| A09: Logging Failures | ✅ Partial | 30+ | Credentials in logs, insufficient logging, sensitive data exposure |
| A10: SSRF | ✅ Full | 40+ | Server-side request forgery, unsafe URL construction |
CWE Top 25 Coverage
CodeThreat detects CWE Top 25 (2021 & 2022) most dangerous software weaknesses: ✅ Complete coverage of CWE Top 25 including: Injection (CWE-74):- CWE-89: SQL Injection
- CWE-78: OS Command Injection
- CWE-79: Cross-Site Scripting
- CWE-91: XML Injection
- CWE-943: NoSQL Injection
- CWE-327: Broken/Risky Crypto
- CWE-328: Weak Hash
- CWE-330: Weak Random
- CWE-331: Insufficient Entropy
- CWE-326: Inadequate Encryption
- CWE-287: Improper Authentication
- CWE-306: Missing Authentication
- CWE-307: Improper Restriction of Excessive Authentication Attempts
- CWE-798: Use of Hard-coded Credentials
- CWE-285: Improper Authorization
- CWE-862: Missing Authorization
- CWE-863: Incorrect Authorization
- CWE-79: Cross-Site Scripting
- CWE-22: Path Traversal
- CWE-416: Use After Free
- CWE-434: Unrestricted Upload
- CWE-352: CSRF
- CWE-601: Open Redirect
- And 100+ more CWE categories
Language-Specific Vulnerabilities
Python-Specific
✅ Django template injection✅ Pickle deserialization
✅ Eval/exec code execution
✅ YAML unsafe load
✅ Flask Jinja2 SSTI
✅ SQLAlchemy injection
✅ subprocess shell injection
JavaScript/TypeScript-Specific
✅ Prototype pollution✅ RegExp DoS
✅
eval() and Function() usage✅
innerHTML XSS✅ Express route parameter injection
✅ JWT algorithm confusion
✅ Path traversal
Java-Specific
✅ Deserialization of untrusted data✅ JNDI injection (Log4Shell-style)
✅ Spring SpEL injection
✅ XML External Entity (XXE)
✅ JDBC SQL injection
✅ Reflection abuse
Go-Specific
✅ SQL injection in database/sql✅ Command injection in exec.Command
✅ Path traversal
✅ Unsafe reflection
✅ Race conditions
Infrastructure as Code
Terraform (362 rules): ✅ Public S3 buckets✅ Unencrypted storage
✅ Overly permissive IAM
✅ Missing security groups
✅ Insecure network configs Kubernetes/YAML (120 rules): ✅ Privileged containers
✅ Host network access
✅ Missing resource limits
✅ Insecure volume mounts
✅ Exposed secrets Dockerfile (35 rules): ✅ Running as root
✅ Vulnerable base images
✅ Exposed secrets
✅ Missing health checks
Blockchain/Smart Contracts
Solidity (50 rules): ✅ Reentrancy vulnerabilities✅ Integer overflow/underflow
✅ Unchecked external calls
✅ Access control issues
✅ Gas optimization
Compliance and Standards
OWASP Top 10 (2021): Full coverage of all 10 categories with 1,000+ relevant rules CWE Top 25: Complete coverage of most dangerous weaknesses (2021 & 2022 lists) SANS Top 25: Aligned with SANS/CWE Most Dangerous Software Errors Rules are tagged with compliance standards for easy filtering and reporting.While CodeThreat doesn’t have specific PCI-DSS or HIPAA rule sets, our OWASP Top 10 and CWE coverage addresses the security requirements mandated by these compliance frameworks.
What Makes Our SAST Different
1,740+ Rules: More coverage than most commercial tools OpenGrep + ShiftQL: We enhanced Semgrep with our own intelligence layer Framework-Aware: Understands Django ORM, React escaping, Spring Security, Rails protections Low False Positives: Rules tuned for precision, then AI filters context-aware Continuous Updates: New rules added weekly for emerging vulnerability patternsWhat’s Next?
SCA Support Matrix
Dependency scanning coverage
Run Your First Scan
Start scanning for vulnerabilities
Scan Types Explained
Understanding SAST, SCA, Secrets, IaC