So, coming from the observability world, I'm used to checking the "official support" list for a tool and then immediately digging into what *actually* works well in practice. The docs say "30+ languages," but that's a wide net. For a beginner trying to build this into a CI pipeline, what's the real state of things?
From my own tinkering and reading various threads:
* **Tier 1 (Excellent, full rule syntax, few false positives):** JavaScript/TypeScript, Go, Python, Java, C#, PHP. These feel mature. You can write complex rules with `pattern-either` and metavariables without hitting weird parser edges.
* **Tier 2 (Good, core features work):** Ruby, Kotlin, Swift, Terraform (HCL). Solid for common patterns, though some advanced rule features might be less polished.
* **Tier 3 (Beta/Basic):** C, C++, Rust, Bash. Parsing works for simple `pattern:` searches, but semantic awareness (like understanding types in C++) is limited. I've seen more false positives here.
The big question mark for me is **frameworks**. It says "Dockerfile, Kubernetes, YAML" support, but that's mostly for specific known-issue patterns, right? Like, it's not a full YAML linter; it's scanning for hard-coded secrets or dangerous API object settings.
For example, a good Python rule for a dangerous Flask debug mode might look like this:
```yaml
rules:
- id: flask-debug-enabled
patterns:
- pattern: app.run(..., debug=True, ...)
- pattern: app.run(..., debug=$DEBUG, ...)
message: "Flask debug mode is enabled. Do not deploy this to production."
languages: [python]
severity: ERROR
```
This works flawlessly. But trying to write an equivalent for C++ about, say, raw pointer ownership gets messy fast.
Has anyone run it at scale across a polyglot repo? Did you find the "beta" language support good enough for security linting, or did you have to suppress a ton of noise? I'm trying to gauge if I can standardize on it for *all* languages, or if it's a "Tier 1 only" tool and I need something else for the C++ codebase.
Alert fatigue is real, but so is my rule of silence.
Your tier list is a solid practical summary. Where you mention frameworks like Dockerfile and Kubernetes, you're right - it's not about linting syntax. The support there is essentially a set of built-in rules for common security anti-patterns: hard-coded secrets in YAML resources, `latest` tags in Dockerfiles, or overly permissive `securityContext` settings. You can't write a custom rule to enforce, say, a specific label schema on all your Deployments. For that, you'd still need something like Polaris or a custom Kyverno policy.
One caveat on your Tier 1: Java and C# can get tricky with enterprise codebases that use heavy annotation processing or complex generics. The parse trees sometimes break on those edges, leading to missed findings, not false positives. It's mature for standard language constructs, but the moment you step into framework-specific DSL territory, coverage drops.