> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAST Support Matrix

> Complete language and framework coverage for static code analysis

CodeThreat uses **OpenGrep** (our enhanced fork of Semgrep) combined with **ShiftQL's intelligent analysis** to provide comprehensive static application security testing across 27+ languages with **1,740+ security rules**.

## Supported Languages

### Primary Languages (Deep Coverage)

| Language       | Rules | Frameworks Supported                  | Coverage                 |
| -------------- | ----- | ------------------------------------- | ------------------------ |
| **Python**     | 334   | Django, Flask, FastAPI, Pyramid       | OWASP Top 10, CWE Top 25 |
| **Terraform**  | 362   | AWS, Azure, GCP, Kubernetes           | Infrastructure security  |
| **JavaScript** | 173   | React, Vue, Angular, Express, Node.js | Frontend & backend       |
| **Java**       | 121   | Spring, Jakarta EE, Struts, Play      | Enterprise applications  |
| **TypeScript** | 30    | React, Angular, Next.js, NestJS       | Modern web apps          |
| **Go**         | 76    | Gin, Echo, Fiber, standard library    | Cloud-native apps        |
| **Ruby**       | 92    | Rails, Sinatra, Grape                 | Web applications         |
| **PHP**        | 61    | Laravel, Symfony, WordPress, Drupal   | CMS and web apps         |
| **C#**         | 51    | ASP.NET, .NET Core, Entity Framework  | Windows & cross-platform |

### Additional Languages

| Language            | Rules | Use Cases                                  |
| ------------------- | ----- | ------------------------------------------ |
| **YAML/Kubernetes** | 120   | K8s manifests, Helm charts, docker-compose |
| **Scala**           | 27    | Play Framework, Akka, Spark                |
| **Solidity**        | 50    | Smart contracts, DeFi, blockchain          |
| **Kotlin**          | 14    | Android, Spring Boot, server-side          |
| **Rust**            | 10    | Systems programming, web services          |
| **Swift**           | 4     | iOS, macOS applications                    |
| **Elixir**          | 7     | Phoenix Framework                          |
| **OCaml**           | 23    | Functional programming                     |
| **Bash/Shell**      | 6     | Scripts, DevOps automation                 |
| **C/C++**           | 16    | Systems programming                        |
| **Apex**            | 18    | Salesforce development                     |
| **Clojure**         | 5     | JVM functional programming                 |
| **Dockerfile**      | 35    | Container security                         |
| **HTML**            | 6     | Template security                          |
| **JSON**            | 4     | Configuration security                     |

### Generic Rules

**37 problem-based rules** that work across all languages:

* Hardcoded secrets
* Insecure random number generation
* Weak cryptography
* Insecure deserialization
* And more

**25 AI-specific rules** for emerging AI/ML security concerns

## Framework-Specific Detection

### Web Frameworks

**Python**:

* Django ORM injection detection
* Flask template injection
* FastAPI security misconfigurations
* Pyramid authorization flaws

**JavaScript/TypeScript**:

* React XSS and dangerouslySetInnerHTML
* Vue.js template injection
* Express.js route security
* Next.js API route vulnerabilities

**Java**:

* Spring Security misconfigurations
* Hibernate/JPA injection
* Jakarta EE authentication flaws
* Struts OGNL injection

**Ruby**:

* Rails mass assignment
* ActiveRecord SQL injection
* Sinatra route security
* Rails CSRF bypass

**PHP**:

* Laravel query injection
* Symfony security component misuse
* WordPress plugin vulnerabilities
* Drupal access control

**Go**:

* Gin parameter injection
* Echo template rendering
* Standard library SQL issues
* Goroutine race conditions

### Mobile Frameworks

**iOS (Swift)**:

* KeyChain misuse
* Insecure data storage
* SSL pinning issues

**Android (Kotlin/Java)**:

* Intent injection
* WebView security
* SharedPreferences exposure

## Vulnerability Categories

### OWASP Top 10 (2021) Coverage

| OWASP 2021 Category                | Detection   | Rule Count | Examples                                                                 |
| ---------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------ |
| **A01: Broken Access Control**     | ✅ Full      | 100+       | Missing authorization, IDOR, path traversal, privilege escalation        |
| **A02: Cryptographic Failures**    | ✅ Full      | 80+        | MD5/SHA1 usage, weak crypto, hardcoded secrets, insecure random          |
| **A03: Injection**                 | ✅ Full      | 400+       | SQL, NoSQL, Command, LDAP, XPath, XML, OS command injection              |
| **A04: Insecure Design**           | ✅ Partial   | 50+        | Missing rate limiting, trust boundary violations, security anti-patterns |
| **A05: Security Misconfiguration** | ✅ Full      | 150+       | Debug enabled, defaults, CORS, headers, verbose errors                   |
| **A06: Vulnerable Components**     | ⚠️ SCA Tool | -          | Use Trivy SCA for dependency vulnerabilities                             |
| **A07: Auth/Session Failures**     | ✅ Full      | 90+        | Broken auth, session fixation, weak passwords, missing MFA               |
| **A08: Data Integrity Failures**   | ✅ Full      | 70+        | Insecure deserialization (Pickle, YAML, JSON), unsigned JWTs             |
| **A09: Logging Failures**          | ✅ Partial   | 30+        | Credentials in logs, insufficient logging, sensitive data exposure       |
| **A10: SSRF**                      | ✅ Full      | 40+        | Server-side request forgery, unsafe URL construction                     |

**Compliance**: Rules tagged with OWASP 2017 and OWASP 2021 categories

### CWE Top 25 Coverage

CodeThreat detects **CWE Top 25 (2021 & 2022)** most dangerous software weaknesses:

✅ **Complete coverage** of CWE Top 25 including:

**Injection (CWE-74)**:

* CWE-89: SQL Injection
* CWE-78: OS Command Injection
* CWE-79: Cross-Site Scripting
* CWE-91: XML Injection
* CWE-943: NoSQL Injection

**Cryptography (CWE-310)**:

* CWE-327: Broken/Risky Crypto
* CWE-328: Weak Hash
* CWE-330: Weak Random
* CWE-331: Insufficient Entropy
* CWE-326: Inadequate Encryption

**Authentication (CWE-287)**:

* CWE-287: Improper Authentication
* CWE-306: Missing Authentication
* CWE-307: Improper Restriction of Excessive Authentication Attempts
* CWE-798: Use of Hard-coded Credentials

**Authorization (CWE-285)**:

* CWE-285: Improper Authorization
* CWE-862: Missing Authorization
* CWE-863: Incorrect Authorization

**Additional CWE Coverage**:

* CWE-79: Cross-Site Scripting
* CWE-22: Path Traversal
* CWE-416: Use After Free
* CWE-434: Unrestricted Upload
* CWE-352: CSRF
* CWE-601: Open Redirect
* And 100+ more CWE categories

**Compliance Tags**: Rules are tagged with CWE-2021-Top-25 and CWE-2022-Top-25 for prioritization

## Language-Specific Vulnerabilities

### Python-Specific

✅ Django template injection\
✅ Pickle deserialization\
✅ Eval/exec code execution\
✅ YAML unsafe load\
✅ Flask Jinja2 SSTI\
✅ SQLAlchemy injection\
✅ subprocess shell injection

### JavaScript/TypeScript-Specific

✅ Prototype pollution\
✅ RegExp DoS\
✅ `eval()` and `Function()` usage\
✅ `innerHTML` XSS\
✅ Express route parameter injection\
✅ JWT algorithm confusion\
✅ Path traversal

### Java-Specific

✅ Deserialization of untrusted data\
✅ JNDI injection (Log4Shell-style)\
✅ Spring SpEL injection\
✅ XML External Entity (XXE)\
✅ JDBC SQL injection\
✅ Reflection abuse

### Go-Specific

✅ SQL injection in database/sql\
✅ Command injection in exec.Command\
✅ Path traversal\
✅ Unsafe reflection\
✅ Race conditions

### Infrastructure as Code

**Terraform** (362 rules):
✅ Public S3 buckets\
✅ Unencrypted storage\
✅ Overly permissive IAM\
✅ Missing security groups\
✅ Insecure network configs

**Kubernetes/YAML** (120 rules):
✅ Privileged containers\
✅ Host network access\
✅ Missing resource limits\
✅ Insecure volume mounts\
✅ Exposed secrets

**Dockerfile** (35 rules):
✅ Running as root\
✅ Vulnerable base images\
✅ Exposed secrets\
✅ Missing health checks

### Blockchain/Smart Contracts

**Solidity** (50 rules):
✅ Reentrancy vulnerabilities\
✅ Integer overflow/underflow\
✅ Unchecked external calls\
✅ Access control issues\
✅ Gas optimization

## Compliance and Standards

**OWASP Top 10 (2021)**: Full coverage of all 10 categories with 1,000+ relevant rules

**CWE Top 25**: Complete coverage of most dangerous weaknesses (2021 & 2022 lists)

**SANS Top 25**: Aligned with SANS/CWE Most Dangerous Software Errors

Rules are tagged with compliance standards for easy filtering and reporting.

<Note>
  While CodeThreat doesn't have specific PCI-DSS or HIPAA rule sets, our OWASP Top 10 and CWE coverage addresses the security requirements mandated by these compliance frameworks.
</Note>

## What Makes Our SAST Different

**1,740+ Rules**: More coverage than most commercial tools

**OpenGrep + ShiftQL**: We enhanced Semgrep with our own intelligence layer

**Framework-Aware**: Understands Django ORM, React escaping, Spring Security, Rails protections

**Low False Positives**: Rules tuned for precision, then AI filters context-aware

**Continuous Updates**: New rules added weekly for emerging vulnerability patterns

<Tip>
  Enable SAST scanning to catch code-level vulnerabilities before they reach production. Most findings can be fixed in minutes once identified.
</Tip>

## What's Next?

<CardGroup cols={2}>
  <Card title="SCA Support Matrix" icon="box" href="/reference/sca-support-matrix">
    Dependency scanning coverage
  </Card>

  <Card title="Run Your First Scan" icon="play" href="/scanning/running-scans">
    Start scanning for vulnerabilities
  </Card>

  <Card title="Scan Types Explained" icon="magnifying-glass" href="/scanning/scan-types">
    Understanding SAST, SCA, Secrets, IaC
  </Card>
</CardGroup>