# Code Risk Language and Framework Support

## Rules Methodology

***

Arnica's scanners leverage a combination of open source libraries and Arnica's internally maintained Global Rules.\
\
This rules framework combines the growth engine of open source contribution and the scan quality of a managed service, resulting in expansive coverage with quality scanning results.\
\
Arnica also allows organizations to define custom rules for SAST and Secret scanning, allowing for customized coverage and detection of org specific code or tokens.

***

## Full Language and Framework Support

The following languages and frameworks are supported out of the box within Arnica.

<table data-full-width="true"><thead><tr><th width="244">Language/Framework</th><th width="186">SAST</th><th width="239">SCA/License</th><th width="133">Reputation</th><th width="205">IaC</th></tr></thead><tbody><tr><td>.Net</td><td>C# is GA</td><td>packages.lock.json, packages.config, .deps.json</td><td>NuGet</td><td>N/A</td></tr><tr><td>Azure Resource Manager (ARM)</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA</td></tr><tr><td>Bash</td><td>Experimental</td><td>N/A</td><td>N/A</td><td>N/A</td></tr><tr><td>C</td><td>GA</td><td>conan.lock</td><td>-</td><td>N/A</td></tr><tr><td>C++</td><td>GA</td><td>conan.lock</td><td>-</td><td>N/A</td></tr><tr><td>Clojure</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>CloudFormation</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA, including AWS SAM</td></tr><tr><td>Dart</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Docker</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA</td></tr><tr><td>L</td><td>Experimental</td><td>mix.lock</td><td>-</td><td>N/A</td></tr><tr><td>Go</td><td>GA</td><td>go.mod</td><td>Go</td><td>N/A</td></tr><tr><td>Helm Charts</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA</td></tr><tr><td>HTML</td><td>Experimental</td><td>N/A</td><td>N/A</td><td>N/A</td></tr><tr><td>Java</td><td>GA</td><td>Files: JAR, WAR, EAR. Packages: pom.xml, gradle.lockfile</td><td>Maven</td><td>N/A</td></tr><tr><td>JavaScript (including JSX, TSX, TypeScript)</td><td>GA</td><td>package-lock.json, yarn.lock, pnpm-lock.yaml</td><td>NPM</td><td>N/A</td></tr><tr><td>Jsonnet</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Julia</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Kotlin</td><td>Beta</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Kubernetes</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA</td></tr><tr><td>Lisp</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Lua</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>OCaml</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>PHP</td><td>GA</td><td>composer.lock</td><td>-</td><td>N/A</td></tr><tr><td>Python</td><td>GA</td><td>Pipfile.lock, poetry.lock, requirements.txt</td><td>PyPi</td><td>N/A</td></tr><tr><td>R</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Ruby</td><td>GA</td><td>Gemfile.lock</td><td>-</td><td>N/A</td></tr><tr><td>Rust</td><td>Beta</td><td>Cargo.lock</td><td>Cargo</td><td>N/A</td></tr><tr><td>Scala</td><td>GA</td><td>Same as Java</td><td>-</td><td>N/A</td></tr><tr><td>Scheme</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Serverless Framework</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA</td></tr><tr><td>Solidity</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Swift</td><td>Experimental</td><td>-</td><td>-</td><td>N/A</td></tr><tr><td>Terraform</td><td>N/A</td><td>N/A</td><td>N/A</td><td>GA: AWS, GCP, Azure and OCI</td></tr></tbody></table>

\*Scanning coverage is subject to change base on your tenants tier.