Supported languages and frameworks

On the languages below, Vulkro does full source analysis. It finds your endpoints, builds the route table, reads the access-control model, maps findings to OWASP API Top 10 categories, tracks tainted data with framework awareness, and matches dependencies against a local CVE bundle. Everything runs offline.

Every language is Free

No language is a tier. Every extractor below, Java and Spring included, runs on Free with no account, on one repository at a time. Pro gates features, never languages: see Pricing for what it adds. Salesforce (Apex, Lightning Web Components, Aura, Flow, Visualforce, metadata) is the separate Vulkro for Salesforce product (vulkro-sf), also Free on one project.

Java and Spring are first-class: endpoint extraction, access-control extraction from annotations and the security filter chain, 30 dedicated Java detectors, cross-method taint, and Maven dependency-CVE matching. See the Java and Spring page.

Capability matrix

Language	Endpoint discovery	Access model	Interprocedural taint	Dedicated detectors	SCA ecosystem
Python	Yes	Yes	Yes	Yes	PyPI
JavaScript / TypeScript	Yes	Yes	Yes	Yes	npm
Go	Yes	Yes	Yes	Yes	Go modules
Java / Spring	Yes	Yes	Yes (same-file)	Yes (30)	Maven
PHP	No	No	Single function	Yes	(manifest read; no advisory bundle yet)
C	No	No	Single function	Yes	No
C++	No	No	Single function	Yes	No

For Python, JavaScript, TypeScript, and Go, taint tracking follows the project call graph, including across files (up to a bounded depth). Java taint follows call chains within a single file; it does not yet cross file boundaries. See Taint analysis.

C, C++ and PHP

These three are newer and shallower than the four web languages above, and the table says so. Each gets a fleet of dedicated detectors (the dangerous C library calls, uncontrolled format strings, insecure temporary files and randomness, unchecked privilege drops, allocation-size overflows and use-after-free shapes for C and C++; SQL, command, code and template injection, file inclusion, unsafe unserialize and file upload, SSRF, weak cryptography, type-juggling authentication bypass, header and mail injection, and LDAP/XPath injection for PHP) plus taint tracking inside a single function: input from a request superglobal, a Laravel, Symfony, PSR-7 or CodeIgniter request object, argv, getenv, read or recv reaching a dangerous call in the same function is reported as proven. A value that leaves the function is not followed. There is no route discovery and no access model for these languages, and C and C++ are not checked for memory safety in the general sense: no bounds proofs, no value-range analysis. The C detectors also run on C++ sources.

For any other stack, Vulkro still runs its language-agnostic passes: secrets, infrastructure-as-code, container scanning, and dependency-CVE matching (for the ecosystems listed below). What it cannot do without first-class support is framework-aware endpoint discovery and taint tracking. If your stack is missing, email support@vulkro.com with the framework name and a small example repo. We add coverage based on real demand.

Web frameworks

Python

FastAPI, Flask, Django, Django REST Framework (DRF), Django Ninja, Starlette, aiohttp, Tornado, Litestar.

JavaScript / TypeScript

Express, Fastify, NestJS, Next.js (App Router and Pages Router), Hono, Koa, Hapi, Elysia, AdonisJS, tRPC.

Go

net/http, Gin, Echo, Chi, gorilla/mux, Fiber.

Java / Spring

Spring MVC and Spring WebFlux (@GetMapping / @PostMapping / @PutMapping / @DeleteMapping / @PatchMapping / @RequestMapping, class-level base paths included) and JAX-RS (@Path with @GET / @POST / @PUT / @DELETE / @PATCH / @HEAD / @OPTIONS). See Java and Spring.

Salesforce

Salesforce (Apex, Lightning Web Components, Aura, Flow, Visualforce, and metadata) is covered by the separate Vulkro for Salesforce product (the vulkro-sf binary), not by this scanner. See the Vulkro for Salesforce docs.

Cross-cutting

• GraphQL (Apollo, graphql-yoga, Strawberry, graphene)
• gRPC
• WebSocket (ws, Socket.IO, Starlette WebSockets)
• React (client-side surface for XSS and DOM-sink analysis)
• Angular (same)

Package ecosystems for dependency-CVE matching

Ecosystem	Manifests parsed	Resolved version from	Status
npm	package.json	package-lock.json	Parsed
PyPI	requirements*.txt, Pipfile, pyproject.toml	poetry.lock, Pipfile.lock	Parsed
Go modules	go.mod	go.mod (MVS)	Parsed
crates.io	Cargo.toml	Cargo.lock (manifest dir or workspace root)	Parsed
Maven	pom.xml (<dependencies>)	<version> / <properties> (no parent-POM / BOM)	Parsed
Gradle	build.gradle, build.gradle.kts	-	Not yet
RubyGems	Gemfile, Gemfile.lock	-	Not yet
Packagist	composer.json, composer.lock	-	Not yet
NuGet	*.csproj, packages.config	-	Not yet

Maven (pom.xml) is parsed for CVE matching, so a Java / Spring project gets dependency coverage on top of its source analysis. Gradle dependencies are not parsed yet: a Gradle project is still detected as Java and scanned for code, but its build.gradle dependencies do not produce CVE findings. Cargo (Rust) and crates.io are dependency-CVE only: they add supply-chain coverage without adding Rust source analysis.

The live OSV lookup covers every Parsed ecosystem. Fully offline (VULKRO_OFFLINE=1) matching also needs that ecosystem's file in the local CVE bundle. The default bundle ships npm + PyPI; a wider bundle can add Go, Maven, and crates.io. Go, Cargo, and Maven findings are not in the reachability call-shape set, so they come without a [reachable] / [unreachable] tag. Secrets, IaC, and container scanning run on every repo.

Linux distro packages (container scanning)

For vulkro container against Docker images: Alpine, Debian, Ubuntu, Rocky Linux. Distro coverage is opt-in because the per-distro CVE feed is large; enable it with the container ecosystem flag on vulkro update.

Infrastructure-as-code

Vulkro statically checks these formats for misconfiguration:

• Terraform (*.tf)
• Kubernetes manifests (*.yaml)
• Helm charts (values.yaml, templates)
• Docker Compose (docker-compose.yml, compose.yaml)
• Dockerfiles
• nginx, Apache (nginx.conf, *.conf)

Secrets scanning (vulkro scan --scope src) and infrastructure misconfiguration checks work on any text-based file, regardless of language.

What "not yet supported" means in practice

If your stack uses a language or framework not on the lists above:

• Endpoint discovery will not enumerate your routes automatically.
• Taint analysis falls back to generic sources / sinks and may miss framework-specific patterns.
• Reachability gating is less precise: findings tagged reachable are over-reported to be safe, rather than missed.
• Secrets, dependency-CVE, IaC, and container scans are unaffected and keep working.

The honest read: Vulkro is most accurate on the stacks listed here. We add new frameworks every release based on what paying customers ship.