Rig looks for security problems that can be detected in application code. Setup tailors the checks to your project.
Security categories
Rig targets these nine categories from the OWASP Top 10:2025, a widely used list of application-security risks.
| Category | Examples of code-level problems |
|---|---|
| Broken access control | Missing ownership checks or unintended access to another user’s data. |
| Security misconfiguration | Unsafe cookie settings, permissive request policies, or exposed debug behavior. |
| Cryptographic failures | Weak encryption choices or unsafe handling of cryptographic keys. |
| Injection | User input changing a database query, shell command, or executable code. |
| Insecure design | Missing security rules in sensitive application workflows. |
| Authentication failures | Unsafe identity checks or session handling. |
| Software or data integrity failures | Accepting untrusted serialized data or failing to verify data integrity. |
| Security logging and alerting failures | Secrets in logs or user input that can forge log entries. |
| Mishandling of exceptional conditions | Error paths that expose sensitive information or fail unsafely. |
Languages and file formats
Rig supports the following languages and formats. Language support does not mean every security category has equivalent checks in every language.
- Apex
- Bash
- C
- C++
- C#
- Clojure
- Crystal
- Dart
- Dockerfile
- Elixir
- Go
- HTML
- Java
- JavaScript
- JSON
- Jsonnet
- JSX
- Julia
- Kotlin
- Lisp
- Lua
- OCaml
- PHP
- Python
- R
- Ruby
- Rust
- Scala
- Scheme
- Solidity
- Swift
- Terraform
- TSX
- TypeScript
- Visual Basic
- XML
- YAML
- Generic (ERB, Jinja, etc.)
Check your project’s configuration
Ask your agent which rules apply to your project and where it could not prepare a useful check. That is more informative than treating a supported-language list as a guarantee of coverage.