Supported languages and frameworks
This page lists what Vulkro scans and how deep the analysis goes for each language. Every language is included in the trial and in Pro.
Languages
| Language | Endpoint discovery | Access model | Taint tracking | Dedicated detectors | Dependency CVEs |
|---|---|---|---|---|---|
| JavaScript / TypeScript | Yes | Yes | Across files | Yes | npm |
| Python | Yes | Yes | Across files | Yes | PyPI |
| Go | Yes | Yes | Across files | Yes | Go modules |
| Java / Spring | Yes | Yes | Across files, by declared type | Yes | Maven, Gradle lockfile |
| PHP | No | No | Within one function | Yes | Packagist |
| C | No | No | Within one function | Yes | No |
| C++ | No | No | Within one function | Yes (C detectors also run) | No |
| Rust | No | No | No | unsafe and FFI checks only | crates.io |
For PHP, C and C++, a request value reaching a dangerous call in the same function is reported as proven; a value that leaves the function is not followed. C and C++ get no general memory-safety proof (no bounds or value-range analysis).
Ruby, Kotlin and C# are not analysed. A scan that finds them says so by name and file count. Their lockfiles (Gemfile.lock, packages.lock.json) are still matched for CVEs.
Salesforce (Apex, Lightning Web Components, Aura, Flow, Visualforce, metadata) is covered by the separate vulkro-sf binary. See Vulkro for Salesforce.
Web frameworks
| Language | Frameworks |
|---|---|
| JavaScript / TypeScript | Express, Fastify, NestJS, Next.js (App Router and Pages Router), Hono, Koa, Hapi, Elysia, AdonisJS, tRPC |
| Python | FastAPI, Flask, Django, Django REST Framework, Django Ninja, Starlette, aiohttp, Tornado, Litestar |
| Go | net/http, Gin, Echo, Chi, gorilla/mux, Fiber |
| Java | Spring MVC and WebFlux (mapping annotations, class-level base paths), JAX-RS |
| PHP (taint sources) | Laravel, Symfony, PSR-7 / Slim / Mezzio, CodeIgniter 4, CakePHP |
| Cross-cutting | GraphQL (Apollo, graphql-yoga, Strawberry, graphene), gRPC, WebSocket (ws, Socket.IO, Starlette), React and Angular client-side sinks |
Vue (.vue) and Svelte (.svelte) files are read by the text-based rules, such as the v-html and {@html} XSS checks.
Dependency ecosystems
npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. The files read for each are listed on Dependencies & CVEs.
Infrastructure and pipeline files
| Area | Files |
|---|---|
| Cloud IaC | Terraform (*.tf), AWS CloudFormation, Serverless Framework (serverless.yml), Azure Bicep and ARM templates, Firestore rules |
| Containers and orchestration | Dockerfiles, Docker Compose, Kubernetes manifests, Helm charts |
| Web servers | nginx, Apache (*.conf) |
| CI/CD pipelines | GitHub Actions, GitLab CI, CircleCI, Azure Pipelines, Bitbucket Pipelines |
| Container images | vulkro container: Alpine, Debian, Ubuntu and RHEL-family packages |
Secrets scanning runs on every text file, in any language.
Unsupported stacks
On a stack not listed here, Vulkro still runs secrets, IaC, container and dependency-CVE checks, but cannot discover routes or follow framework-specific data flow. To ask for a framework, email support@vulkro.com with its name and a small example repository.
See also: Taint analysis