Supported languages

Last updated 2 October 2026.

Which languages does MergeSafe support?

MergeSafe reviews pull requests in any programming language: there is no list of supported languages, and every level includes the Standard security review whatever the language.

What some languages get on top

• Go: Go-specific security checks when a pull request changes .go files, go.mod or go.sum. Go findings carry their own Go badge.
• Ruby and Rails: SQL injection checks tuned for Ruby when a pull request changes Ruby files, a Gemfile or a Rakefile.
• Python, JavaScript and TypeScript: to prove a logic bug, a review may run a short script in an isolated sandbox. This is only to show the bug is real, never to test security.

Files that don’t count toward size

Lockfiles, snapshots, vendored code, minified files and generated code don’t count toward the large pull request limits. A file only counts as one of these when both its path and its contents look the part. Database migrations always count and are always reviewed.

What is not checked in any language

• Dependency vulnerabilities (CVEs) in lockfiles and manifests.
• Infrastructure as code gets the general review only, with no dedicated infrastructure security checks.

The full list is on Security checks. For language-specific guides, see MergeSafe for Python teams and MergeSafe for TypeScript and JavaScript teams.

Next: Severity P0 to P3 →