Audit tools & languages

A full audit is broad: Hyrax runs a large catalog of checks across your whole repository. You don't pick tools or build a profile — breadth is the point, because the value of catching the thing you weren't looking for is high. How much of the catalog an audit runs depends on the depth you pick (see Audit depth below).

For how an audit runs, see How Hyrax works. For what it produces, see Findings & suggestions.

What an audit covers

A full audit checks your code across six categories; the Standard audit covers four of them fully, plus the dependency checks from Operations (see Audit depth). A finding's category tells you which lens produced it.

• Security — auth and access control, vulnerabilities, leaked secrets, supply-chain exposure, PII handling, and compliance gaps (GDPR, SOC 2, HIPAA).
• Correctness — concurrency bugs, test coverage, state handling, resilience, accessibility, internationalization, and wasteful resource use.
• Maintainability — code structure and naming, duplication, dead code, deprecated APIs, error handling, and stalled migrations.
• Performance — slow queries and hot paths, frontend render and Core Web Vitals, and JavaScript bundle size.
• Architecture — API contracts and documentation, versioning, input validation, database and schema risks, and tenant isolation in your own code.
• Operations — observability, logging, configuration, deployment safety, dependency vulnerabilities and licenses, stale feature flags, monorepo health, and docs that have drifted from the code.

Dependency checks go beyond pattern matching: Hyrax runs your ecosystem's native package-audit commands and queries package registries for real vulnerability data, then layers on license, lockfile, and supply-chain checks.

Supported languages

Hyrax classifies and audits these languages:

Python	JavaScript	TypeScript	Go
Rust	Swift	Ruby	Java
Kotlin	C#	C++	C
PHP	Scala	Dart	Elixir
Shell	Lua	MDX

A few things to know:

• HCL / Terraform is not supported.
• Polyglot repos still get audited. A repo that mixes supported and unsupported languages is audited fine — the unsupported parts are skipped, and the reasoning agents bring useful judgment even to languages without bespoke rules.

Audit depth

The catalog above is what the Full audit runs. The audit comes in two depths, and both are available on every plan — depth is a choice about how much you want to spend on a given run, not something your plan unlocks:

• Standard audit — the same engine as the Full audit over a focused 24-tool subset: all of security, correctness, maintainability, and performance, plus dependency checks. It drops the architecture group and the rest of operations.
• Full audit — the complete ~39-tool catalog described above, including architecture analysis and the full operations set. The Standard audit's tools are a strict subset of it.

In the app, the audit button reads Run Standard Audit and clicking it runs that depth. A menu next to the button lets you choose the level; picking Full audit there runs the complete catalog after a quick confirmation, because it takes longer and costs more. See Workflows.

Audits never start on their own — the first audit on a repository is always yours to trigger. What does run automatically is Discovery, on the first repository you connect and on any public repository you add by URL; auditing a repository requires its Discovery to have completed.

Where to go next

• How Hyrax works — what happens during a run
• Workflows — every job you can run
• Findings & suggestions — reading and triaging results