---
title: "What Rig Checks"
description: "The application-security categories, languages, and file formats Rig targets."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.rig.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# What Rig Checks

Rig looks for security problems that can be detected in application code. Setup tailors the checks to your project.

## Security categories

Rig targets these nine categories from the OWASP Top 10:2025, a widely used list of application-security risks.

| Category | Examples of code-level problems |
| --- | --- |
| Broken access control | Missing ownership checks or unintended access to another user’s data. |
| Security misconfiguration | Unsafe cookie settings, permissive request policies, or exposed debug behavior. |
| Cryptographic failures | Weak encryption choices or unsafe handling of cryptographic keys. |
| Injection | User input changing a database query, shell command, or executable code. |
| Insecure design | Missing security rules in sensitive application workflows. |
| Authentication failures | Unsafe identity checks or session handling. |
| Software or data integrity failures | Accepting untrusted serialized data or failing to verify data integrity. |
| Security logging and alerting failures | Secrets in logs or user input that can forge log entries. |
| Mishandling of exceptional conditions | Error paths that expose sensitive information or fail unsafely. |

> **Scope**
>
> These categories describe what the checks attempt to cover. They do not mean every weakness in a category is detectable.
>
> Software supply-chain checks, including dependency vulnerability scanning, are separate from this application-code scope.

## Languages and file formats

Rig supports the following languages and formats. Language support does not mean every security category has equivalent checks in every language.

<ul className="rig-languages">
  <li>Apex</li><li>Bash</li><li>C</li><li>C++</li><li>C#</li>
  <li>Clojure</li><li>Crystal</li><li>Dart</li><li>Dockerfile</li>
  <li>Elixir</li><li>Go</li><li>HTML</li><li>Java</li><li>JavaScript</li>
  <li>JSON</li><li>Jsonnet</li><li>JSX</li><li>Julia</li><li>Kotlin</li>
  <li>Lisp</li><li>Lua</li><li>OCaml</li><li>PHP</li><li>Python</li>
  <li>R</li><li>Ruby</li><li>Rust</li><li>Scala</li><li>Scheme</li>
  <li>Solidity</li><li>Swift</li><li>Terraform</li><li>TSX</li>
  <li>TypeScript</li><li>Visual Basic</li><li>XML</li><li>YAML</li>
  <li>Generic (ERB, Jinja, etc.)</li>
</ul>

## Check your project’s configuration

Ask your agent which rules apply to your project and where it could not prepare a useful check. That is more informative than treating a supported-language list as a guarantee of coverage.

Source: https://docs.rig.ai/what-rig-checks/index.mdx