Supported Technologies

Languages

Language	Extensions	Status
JavaScript	.js .jsx .mjs .cjs	Supported
TypeScript	.ts .tsx	Supported
SQL	.sql	Supported (migrations)

CODYGIENE does not analyze Python, Go, Rust, Java, or other languages.

Frameworks and ecosystems

Ecosystem	Detection	Analysis depth
Next.js	App Router + Pages Router	Route handlers, Server Actions, redirects, auth signals
React	JSX/TSX	Client boundaries, hooks
Node.js	package.json	Async patterns, child_process, require
Supabase	RLS, auth, service-role	RLS policies, SECURITY DEFINER, GRANT/REVOKE, auth signals
PostgreSQL	SQL migrations	Migration reconstruction, FK/unique extraction, RLS state
Prisma	schema.prisma	Query patterns, raw SQL, unbounded reads
Drizzle	drizzle.config	Query patterns, raw SQL, import-aware provenance

What CODYGIENE detects

• Security: injection, trust boundaries, secrets, RLS gaps, auth, redirects, webhooks
• Performance: N+1 queries, blocking operations, redundant work, query-in-loop
• Code Health: complexity, duplication, dead code, circular deps, architecture
• AI Quality: safeguard divergence, silent failures, test coverage gaps

What CODYGIENE does not detect

• Runtime vulnerabilities (no code execution)
• Database query plans (no database connection)
• Runtime cardinality (no runtime data)
• Complete interprocedural taint analysis
• All JavaScript frameworks (focus on Next.js/React/Node)
• All ORMs (Prisma and Drizzle supported; Kysely/TypeORM not yet)

Not yet supported

• Kysely · not yet supported
• TypeORM · not yet supported
• Deep interprocedural dataflow · same-function scope only
• Complete auth/authorization proof · signals only, not proof
• IDOR proof · deferred (requires data-flow analysis)
• CORS context · deferred (insufficient static signal)
• Runtime index recommendations · not possible without runtime data