Languages #
| Language | Status | Notes |
|---|---|---|
| Python | ✅ Generally available | Calibrated against real codebases |
| JavaScript | ✅ Generally available | Framework-agnostic JavaScript rules |
| TypeScript | ✅ Generally available | Type strictness and credential leak detection |
| PHP | ✅ Generally available | Modern PHP, framework-agnostic |
Frameworks #
| Framework | Status | Notes |
|---|---|---|
| FastAPI | ✅ Generally available | Python scanner with web-API specific rules |
| React | ✅ Generally available | React + JSX safety |
| Node.js | ✅ Generally available | package.json hygiene, dependency safety |
| SQLAlchemy | ✅ Generally available | Python ORM patterns |
| Adobe Commerce / Magento | ✅ Generally available | Magento conventions and architecture |
| Supabase | ✅ Generally available | Auth, JWT, RLS, config |
| Vite | ✅ Generally available | HTML-entry-point security |
| Java | 🔜 Coming soon | Spring Boot rules in development |
| Spring Boot | 🔜 Coming soon | Bundled with the Java scanner |
| Angular | 🔜 Coming soon | TypeScript scanner + Angular-specific rules |
What “auto-detect” means #
When you connect a repository, Norma reads the manifest files (package.json, requirements.txt, pom.xml, composer.json, etc.) and the file extensions in your tree, then assigns a Stack Profile — a bundle of scanners tailored to that stack. You don’t pick scanners manually unless you want to override.
What’s coming next #
- Third-party vulnerability scanner. Flags known CVEs in your dependencies.
- SBOM generation. Produces a software bill of materials for compliance reporting.
- Integration detection. Spots integrations like Stripe, Auth0, OpenAI, etc. that need extra governance.
Release dates for the above are tracked on the public roadmap.
Related #
- Providers — how to connect your repository so it can be scanned.
