Whatever your product is written in
Watchdog reads C#, Java, TypeScript, Python, Go and more, and grades your whole product as one.
Most products are built in more than one language, such as a web service in one, a website in another and background jobs in a third. A team then looks at each part on its own, and it is hard to say how the product as a whole is doing, or which problem to fix first.
Watchdog surveys every part as one product, by the same rules. You get one score from 0 to 100 with a score for each part, one report, and one list of what to fix first, ranked across all the parts. The table below shows every language Watchdog reads, and how far each one is read. Watchdog is where a team begins, and it works alongside the tools the team already runs.
Sign in with GitHub, GitLab, Bitbucket or Azure DevOps · no card · the first survey of every repository you connect is free.
One answer for the whole product
Watchdog weighs every problem against every other, whatever language it is in.
Watchdog reads each part in its own language, then measures all of them by one set of rules. A problem in the website and a problem in the web service go on the same list, ranked by how much each fix raises the score for the work it takes, so the team starts with the fix that matters most.
Because every part is measured the same way, the parts can be compared with each other. The team can see that the product as a whole is in good shape while one service is not. The architecture view shows how the parts depend on each other, so a problem in how two parts connect shows up even when they are written in different languages.
The table below shows how far each language is read. Watchdog is where a team begins: it gives the whole picture first, and Where Watchdog fits explains how it works alongside the specialist tools a team already runs.
Included in every survey
Some of Watchdog's checks work the same, in every language.
Many of Watchdog's checks read the files around the code rather than the code itself: the list of libraries the product uses, its settings files and the history of its changes. So they work the same whatever language the product is written in. These are the checks teams usually buy a scanner for, and they come with every survey, with nothing to install.
Libraries with known security holes
Watchdog checks every library the product uses against the public lists of known security holes, for every package system the product declares, and lists every library in a standard format (CycloneDX SBOM). Between surveys, the daily watch tells the team on the same day when a new hole is published in one of them.
Passwords and keys left in the code
Watchdog looks for passwords and keys in the files as they are today and in the whole history of the code. That includes a key that was committed by mistake and deleted later, because it can still be read in the history.
Container and cloud settings
Watchdog checks the files that set up containers and cloud servers (Docker, Kubernetes, Terraform, Helm and CloudFormation) for unsafe settings, such as a container that runs with full administrator rights.
What the change history shows
Watchdog reads who has worked on which part of the code, so it finds the parts that only one or two people know, and the files that keep changing together with no visible link between them.
The guide Security is not a CVE list explains each of these checks and the tools Watchdog runs for them.
Language by language
Find your language, and see how far Watchdog reads it.
Each row shows which design grades Watchdog reads in that language. These grades need to understand how the code is put together, so how far they reach depends on how much the language spells out in the code itself, such as the type of each value. Everything in the section above works the same for every row.
The word after each language says how much of the design Watchdog can read in that language, from FULL, where every design grade that applies is read in full, down to LOW, where Watchdog reads how the code is put together but not the design built on it. It describes how Watchdog reads the language, not how good the language or your code is. Deep means Watchdog reads the language's types and the design built on them. Structural means it reads how the files and parts depend on each other.
C#
FULLDeepWatchdog reads C# with the C# compiler's own tools, so it understands the code the way the compiler does. Every design grade and every code-level check is read in full.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
F#
VERY HIGHDeepWatchdog reads F# with the F# compiler's own tools. F# code often describes what happens in a business as a set of event types, and builds its current state by replaying those events. Watchdog reads that style directly, so Domain Modelling and Event Sourcing are read in full.
Read forArchitectureDomain ModellingEvent-DrivenEvent Sourcing
Not readCode-level trapsDependency wiringClasses that do too much
Java
VERY HIGHDeepWatchdog reads Java with a tool that works out the types in the code the way the Java compiler does, so the design is read in full. Several code-level trap checks read Java too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringTyped IDs
Kotlin
VERY HIGHDeepWatchdog reads Kotlin with the Kotlin compiler's own tools, so the design is read in full, including the ways Kotlin code usually describes events and values. Several code-level trap checks read Kotlin too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringClasses that do too much
VB.NET
VERY HIGHDeepWatchdog reads VB.NET with the same compiler tools it uses for C#, so the design is read in full.
Read forArchitectureDomain ModellingEvent-DrivenEvent Sourcing
Not readCode-level trapsDependency wiring
Dart
HIGHDeepDart code describes its data in detail, so Watchdog can tell business data apart from screens and database rows. Several code-level trap checks read Dart too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringCompiled .NET program
Elixir
HIGHDeepElixir code usually builds its current state by replaying events, and Watchdog reads that style directly for Domain Modelling and Event Sourcing.
Read forArchitectureDomain ModellingEvent-DrivenEvent Sourcing
Not readRecords that only hold dataClass and type hierarchiesCode-level trapsDependency wiring
PHP
HIGHDeepModern PHP code states the type of each value, so Watchdog can follow which part of the code calls which and read the design from it. Several code-level trap checks read PHP too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringClasses that do too much
Rust
HIGHDeepRust code states the type of each value and which parts of the code may change it, so Watchdog can tell business data apart from database rows, whichever of the common database libraries the code uses.
Read forArchitectureDomain ModellingEvent-DrivenEvent Sourcing
Not readCode-level trapsDependency wiringCompiled .NET program
Scala
HIGHDeepScala code describes its events, values and IDs in detail, so Watchdog can tell business data apart from database rows and messages, and reads Domain Modelling and Event Sourcing from it. Several code-level trap checks read Scala too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringCompiled .NET program
Swift
HIGHDeepSwift code states whether a value is copied or shared, and what each type promises to do, so Watchdog can tell business data apart from stored records, including data kept with Core Data, Realm or SwiftData. The check for errors that are caught and ignored reads Swift too.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringCompiled .NET program
TypeScript
HIGHDeepWatchdog reads TypeScript with the TypeScript compiler's own tools. It can tell an event apart from an error result even when both are written the same way in the same file, and it tells business data apart from database rows, whichever of the common database libraries the code uses.
Read forArchitectureDomain ModellingEvent-DrivenEvent Sourcing
Not readCode-level trapsDependency wiringCompiled .NET program
Erlang
HIGHDeepWatchdog reads Erlang with Erlang's own parser. It finds problems typical of Erlang systems, such as a message handler that blocks while it waits, a change that is saved and sent as a message without making sure both happen, and a query that also changes data. The check for errors that are caught and ignored reads Erlang too.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readRecords that only hold dataClass and type hierarchiesDependency wiring
Go
HIGHDeepWatchdog reads Go with Go's own type checker, the same one Go uses when it builds your code. It reads how the packages depend on each other, how events are handled and replayed, and how business records refer to each other. Several code-level trap checks read Go too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readClass and type hierarchiesClosed sets of event typesDependency wiring
Python
HIGHDeepWatchdog recognises Python's business data by how the code marks it, such as values, database records and events, whether or not the code states its types. Several code-level trap checks read Python too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readClosed sets of event typesDependency wiringClasses that do too much
Ruby
MEDIUMDeepWatchdog recognises Ruby's business data and events by how the code marks them, and reads the event-replaying style Ruby code writes with blocks. Several code-level trap checks read Ruby too, such as the check for errors that are caught and ignored.
Read forArchitectureDomain ModellingEvent-DrivenEvent SourcingCode-level traps
Not readDependency wiringClasses that do too much
JavaScript
LOWStructuralWatchdog reads JavaScript with the TypeScript compiler's own tools. It reads how the modules depend on each other, how complex the code is, how its classes are shaped and which code changes which data.
Read forArchitecture
Not readDomain Modelling and Event Sourcing (as advice only)
Where a check can't read your code, the report says so and gives the reason, and that check is left out of your score instead of counting against you. What we measure explains how the score is shared out. A few checks read only some languages so far, and the table shows which. The check for unfinished functions reads C#, Dart, F#, Java, JavaScript, Ruby, Scala and TypeScript, and the check for tests reads several languages.
How each language earns its place
Every language is tested on real projects before Watchdog offers it.
Read by a tool made for that language
Each language is read by a tool built for it, such as the language's own compiler tools where it has them, so Watchdog understands the code the way the language itself does. Its checks are tuned on code in that language alone, never borrowed from another language that looks alike.
Tested on real projects first
A language is offered only after real projects written in it have been surveyed and the findings have held up when checked. The surveys published on this site are open to read, so you can judge the findings on a project you already know.
A new language never moves your score
When Watchdog adds a language, the rules stay the same, so the scores you already have don't change.
Languages not covered yet
C and C++ are not covered yet, and neither are older business systems such as COBOL and ABAP. The first survey of every repository is free, so you can see what Watchdog reads in your code before you pay anything. If you need a language that isn't covered, tell us: requests decide which language Watchdog adds next.
See your whole product in one survey. The first one is free.
Sign in with GitHub, GitLab, Bitbucket or Azure DevOps · no card · the first survey of every repository you connect is free.
Next: From code host to your first baseline · Architecture drawn from the code, or browse all the guides.
More about Watchdog: What we measure · What you get · When your team codes with AI · Where Watchdog fits with your tools.