No Second-Class Languages

Read the supported-languages list on any scanner and you are reading marketing, not capability. The real question is not how many languages it names. It is how many it does deep work in, and how far the quality sinks between the first language on the list and the last.

Parity is the standard, not the count

We support ten languages today: Python, JavaScript, TypeScript, Go, Rust, Bash, Java, PHP, Ruby, and C, plus Solidity for smart contracts. The number is not the point. The point is that we hold them to one standard. A tainted value in Ruby is traced the same way it is in Python: across files, across function boundaries, from the source where it enters to the sink where it does damage, with the full hop list attached.

The two newest lanes are the proof. C and Solidity are exactly the languages that usually get a shallow, pattern-matching pass if they are covered at all. They now get the full treatment. In our C corpus the analysis follows real flows across files and many hops deep, the same connective work we do in languages we have supported for years. Solidity is traced end to end, from a contract’s public entry points through to the state it touches.

The boundaries where other tools go blind

Real data does not stay inside one language, and it does not stop at the edge of your application code. It crosses from a service into a shell script, from an API handler into a queue, from application code into the infrastructure that deploys it. That last edge is where most tools stop entirely.

We follow it in. Terraform and HCL, AWS CDK, Kubernetes, Helm, Docker and its compose files, nginx configuration, and CI workflows are all read as first-class inputs, not waved off as “not code.” A value that flows from a form, through your service, and out into an infrastructure resource comes back as one continuous trace, not two disconnected scans you have to stitch together by hand.

Honest scope note

Parity is a direction we hold, not a claim that every language is identical in depth on every last construct. Newer lanes have newer edges, and where one falls short the engine reports the gap rather than papering over it. What we will not ship is a headline language count that hides a second tier underneath it. The independent scores at BenchProctor cover the languages one at a time, so the claim answers to something outside our own README.

TheAuditor is in final commercial release preparation, and it ships when the work is ready, not when the calendar says so. Subscribe on the main site for launch news.