SAST languages and source files
On this page
Workbench source analysis is tied to a connected project repository and a pinned commit revision. It reviews that source snapshot; it does not test the deployed application. For a live web or API assessment, use the network workflow.
#Representative language and file families
The current published source-analysis reference names the following examples. They are representative, not a guarantee that every framework, version, or file in a repository is analyzable.
| Family | Examples |
|---|---|
| Go | .go |
| JVM | Java, Kotlin, Scala, Groovy, Clojure, JSP, Gradle, Maven |
| JavaScript and TypeScript | .js, .mjs, .ts, .tsx, Vue, Svelte, Astro |
| Python | .py, .pyi, .pyw |
| PHP | .php, .phtml, .inc |
| Ruby | .rb, .erb, .rake |
| .NET | C#, F#, VB.NET, Razor, .aspx |
| C, C++, and Objective-C | .c, .cpp, .h, .m, .mm |
| Rust and Swift | .rs, .swift |
| Mobile | Dart, Flutter, Android manifests, iOS property lists, React Native |
| Functional languages | Elixir, Erlang, Haskell, Elm, OCaml, Lisp, Gleam |
| Systems and scripting | Zig, Nim, Crystal, PowerShell, Perl, Lua, R, Julia |
| Infrastructure and CI | Terraform, Dockerfile, Helm, Kubernetes, GitHub Actions, GitLab CI, Ansible |
| Data formats | SQL, GraphQL, protobuf, Prisma, Avro, Cypher |
| Smart contracts | Solidity, Vyper, Move, Cairo, Clarity |
| Markup and configuration | HTML, CSS, SVG, XML, JSON, INI, package manifests |
| Notebooks and templates | Jupyter, R Markdown, Quarto, Jinja, Nunjucks, Handlebars, Twig |
| Salesforce | Apex, Visualforce |
#Choose and pin a revision
Open Source repositories under Authorized surface to connect or register a repository. In Assessment setup, choose the project repository and the exact revision to review. Save the setup, then use Start source analysis as a separate action. Workbench checks the pinned revision again before the run starts.
#Review source results
Open Findings register and inspect the file path, line, and code excerpt for each candidate. A language name or generated explanation alone does not confirm a vulnerability. Review the source and context before assigning or exporting a result.
For language-specific support or repository access requirements that are not clear in your workspace, ask your administrator or email contact@eresussec.com.
#Related guides
Need a workflow that is not documented here? Email contact@eresussec.com.