Every language we read, and every one we do not.

• Python

  cross-file, up to 4 hops

  Routes are read from decorators and from URL configuration, so the endpoint inventory is built before any rule runs. Taint follows a request value out of the handler, through helper modules, and into the sink that trusted it, crossing file boundaries through the call graph for up to four hops.

  Frameworks understood

  Django, Django REST Framework, Django Ninja, Flask, FastAPI, Starlette, aiohttp, Tornado, Litestar

  Where it stops

  A route registered by a plugin loader at runtime, or through a factory whose path argument cannot be resolved to a literal, is missing from the inventory. Anything reached only through getattr or a string-keyed registry breaks the call graph, and a path that runs through it is down-ranked rather than reported with a proven trace.

• JavaScript

  cross-file, up to 4 hops

  Router registrations are resolved through their mount prefixes, including across files, so a handler declared in a sub-router is reported at the path it is actually served on rather than the fragment written beside it. Taint crosses module boundaries: a value read from the request in a controller is followed into the service file and the query builder that consume it.

  Frameworks understood

  Express, Koa, Fastify, Hapi, Hono, Elysia, AdonisJS, tRPC, Next.js, plus React and Angular on the front end

  Where it stops

  A mount whose prefix cannot be resolved to a literal leaves its routes recorded at their local path, which reads as a different endpoint than the one you serve. Dynamic property access and callbacks handed through higher-order helpers can drop a call-graph edge, and a dropped edge means a real path is missed rather than guessed at. Bundled and minified output parses, but a finding in it points at a build artifact rather than a line anyone edits.

• TypeScript

  cross-file, up to 4 hops

  Treated as its own grammar rather than as JavaScript with the types stripped, which is what lets decorator-driven routing be read directly. The same four-hop cross-file taint applies, and class methods reached through an interface-typed dependency are resolved to their implementations.

  Frameworks understood

  NestJS, Express, Fastify, Next.js route handlers, tRPC, Angular

  Where it stops

  Types are read as syntax, not resolved by a full type checker. Heavily generic indirection, conditional types and re-export chains can lose an edge, and a lost edge narrows the result rather than widening it.

• Go

  cross-file, up to 4 hops

  Route paths are resolved even when the pattern is assembled from a variable or concatenated, provided the value can be traced to its literal parts. Taint follows a request value across packages and files for up to four hops, and gRPC service definitions are recognised as entry points alongside HTTP handlers.

  Frameworks understood

  net/http, Gin, Echo, chi, gorilla/mux, Fiber, gRPC

  Where it stops

  Interface dispatch where the concrete implementation is only chosen at runtime is not resolved, so a handler wired through such a boundary can be missed. Code behind build tags that were not selected is not analysed.

• Java

  same-file taint only

  Routing is read from the annotations: a class-level @RequestMapping supplies the base path and the method-level mapping family supplies the verb, so the endpoint inventory and the authorization checks around it are as complete as for any other language. A dedicated Java rule set covers injection, unsafe deserialization, XXE, JNDI, expression-language injection, path traversal and Spring Security configuration.

  Frameworks understood

  Spring Boot, Spring MVC, Spring Security, and JAX-RS resources (a class-level @Path with @GET, @POST, @PUT, @DELETE or @PATCH)

  Where it stops

  Taint is same-file. Resolving a Java import onto the source file it names is not wired yet, so a tainted value that leaves the method is not followed into the callee in another file. On the same codebase a Java result set is narrower than a Python or Go one, and that gap is a missing capability rather than a clean bill of health.

Apex is not in this list because it belongs to a different binary. Apex, Lightning components, Flow and org metadata are read by Vulkro for Salesforce, which is this same review pointed at a Salesforce build: the same engine, with a rule set written for the platform rather than for the web.

This is a roadmap fact rather than an apology. Loading a grammar is the cheap half of supporting a language; the expensive half is the framework model, the route extraction and the rule set that make the results worth reading. A language ships here when that second half is done, which is why the supported list is short and why the depth on it is worth quoting.