One Rule System for Every Language
The industry writes the same rule once per language: N weaknesses times M languages, maintained forever. We replaced that with one system that classifies against the public standards, so coverage grows by addition instead of by copy-paste.
Here is the hidden cost in every static analyzer you have used. A rule for SQL injection is not written once. It is written once per language, then maintained once per language, forever. The catalog is N weaknesses times M languages, and every cell is a file somebody has to keep correct. That is why coverage is always lopsided, and why adding a language is a project rather than a config change.
We spent this month replacing that model wholesale.
Classify against the standard, not per language
A weakness is a weakness. SQL injection means the same thing in Go that it means in Python: attacker-controlled input reaching a query without being made safe. How it is spelled differs by language and framework. What makes it that weakness does not.
So the new system states each weakness once, against public standards, and lets the analysis resolve how it shows up in a given language, framework, or piece of infrastructure. Findings are classified by MITRE CWE identity and grouped into the OWASP Top 10 2025 categories, both public references, not a private taxonomy you have to take on faith. Severity is derived from a weakness’s technical impact rather than hand-typed rule by rule, so it is consistent instead of being one author’s opinion in one file.
In one line, and it is the only line we will give you about the internals: dynamic rules queries built on cwe+lang+frame+cloud+category.
Coverage grows by addition
The payoff is in what it costs to get better. In the old model, broadening coverage meant editing a wall of per-language files, the exact wall that killed every previous generation of our rule engine. In the new one, a weakness is stated in one place and applies everywhere the underlying facts already exist. A new language costs the classification layer nothing once its facts are extracted.
That is the difference between a catalog you copy and a system that composes. It is also why we were willing to delete the old engine with nothing staged to replace it. The replacement is not more rules. It is fewer, held against a standard that does not care what language you wrote.
Honest scope note
This is an architecture claim, and we will not dress it up as finished coverage. The classification space is the public CWE catalog, and we are filling it in a deliberate order, reporting each remaining gap by name rather than returning a silent zero for a weakness we have not yet stated. What is proven is proven against BenchProctor, the benchmark whose answer key we do not control. What is not, we will say so.
TheAuditor is in final commercial release preparation and ships when it meets that bar. Subscribe on the main site for launch news.
Was this useful?