Core concepts
Language support
Atmos analyzes four languages today. In each one Atmos follows untrusted data across files, runs pattern rules and checks whether your code can reach a vulnerable dependency. Python is next.
Support matrix#
| Language | Code analysis (SAST) | Dependencies (SCA) | Analyzed | Managed rules |
|---|---|---|---|---|
| JavaScript | cross-file | npm | ● live | ● live |
| TypeScript | cross-file | npm | ● live | ● live |
| Java | cross-file | Maven and Gradle | ● live | ● live |
| C# | cross-file | NuGet | ● live | ● live |
| Python | planned | planned | ◌ planned | ◌ next |
A language is marked analyzed only when every part of the analysis works there, and Python is on the roadmap and not yet scannable. The dependencies column names each language's ecosystems, and how far the evidence can climb in each is in the reachability ladder.
Which files are scanned#
Atmos respects your .gitignore and selects language files automatically: .js .jsx .ts .tsx .mjs .cjs .mts .cts .java and .cs. Minified and vendored files are skipped. Dependency scanning reads the lockfiles listed in SCA and reachability.