> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/code-scanning/scanning-practices/sast-by-aikido-supported-languages-and-security-focus.md).

# SAST/IaC: Supported Languages and Security Focus

### How Aikido SAST currently works <a href="#how-aikido-sast-currently-works" id="how-aikido-sast-currently-works"></a>

Aikido’s SAST engine is built to find and prioritize security issues in your code. No noise, just the vulnerabilities you need to fix.

Aikido SAST engine is based on our **custom risk categorisation model**. Some of these categorisation: -

* Aikido removes findings that are not related to security (eg opinionated code styling rules).
* Findings that reside in repositories that a user categorized as sensitive will get upgraded.
* Findings inside of files that are not intended for production (eg unit tests or functions that aren't used in production) might get downgraded and so on.

Our SAST engine also leverage some of the best open-source engines out there, which we have significantly customized and fine-tuned to provide you sharper, relevant results over the years.

To view all individual rules that are active per language, check out our [SAST Checks](https://app.aikido.dev/repositories/sast) or [Infrastructure as Code](https://app.aikido.dev/repositories/iac) checks to view the rules per language.

### Language support <a href="#language-support" id="language-support"></a>

Aikido is not sensitive to the versions of languages. By default, we support all versions.\
Aikido supports tracking tainted user input from top-level controllers to other files where dangerous functions are used for a growing set of languages.

| **Language**                                                                 | **Base engine**                                    | **Taint analysis**    |
| ---------------------------------------------------------------------------- | -------------------------------------------------- | --------------------- |
| JavaScript                                                                   | Aikido Engine + Opengrep                           | Across multiple files |
| Typescript                                                                   | Aikido Engine + Opengrep                           | Across multiple files |
| PHP                                                                          | Aikido Engine + Opengrep                           | Across multiple files |
| .NET/C#                                                                      | Aikido Engine + Opengrep                           | Across multiple files |
| Java                                                                         | Aikido Engine + Opengrep                           | Across multiple files |
| Rust                                                                         | Aikido Engine + Opengrep                           | Across multiple files |
| Go                                                                           | Aikido Engine + Opengrep                           | Across multiple files |
| Ruby                                                                         | Aikido Engine + Opengrep                           | Across multiple files |
| Python                                                                       | Aikido Engine + Opengrep                           | Across multiple files |
| Scala                                                                        | Aikido Engine + Opengrep                           | Across multiple files |
| C/C++                                                                        | Aikido Engine + Opengrep                           | Across multiple files |
| Visual Basic                                                                 | Aikido Engine + Opengrep                           | Across multiple files |
| Swift                                                                        | Aikido Engine + Opengrep                           | Within files          |
| Android                                                                      | Aikido Engine + Opengrep                           | Within files          |
| Kotlin                                                                       | Aikido Engine + Opengrep                           | Within files          |
| Dart                                                                         | Aikido Engine + Opengrep                           | Within files          |
| Elixir                                                                       | Aikido Engine + Opengrep                           | Within files          |
| Apex                                                                         | Aikido Engine + Opengrep                           | Within files          |
| Clojure                                                                      | Aikido Engine + Opengrep                           | Within files          |
| Infrastructure-as-code files (Terraform, Cloudformation, Docker, Pulumi,...) | Aikido Engine + Checkov                            | Not applicable        |
| Exposed secret discovery in all files inside of Git history                  | Aikido Base Engine with Liveness Checks + Gitleaks | Not applicable        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/code-scanning/scanning-practices/sast-by-aikido-supported-languages-and-security-focus.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.