Languages and frameworks: see the support table. Astro, Vue and Svelte markup is not read, only their scripts. PHP’s inline HTML is read only for its <?= … ?> echoes, and variables a page gets from the files it includes are not followed there: they are judged where those files set them.
Security scope: one function plus at most one hop of callers. This is not whole-program data-flow analysis. Access control reads the final state of policies, SECURITY DEFINER functions and grants across a project’s SQL files in path order, leaving out uninstall, teardown, rollback and down scripts; with --base, unchanged migrations are read for that state but not judged. It does not judge application-level authorization or dynamic SQL inside database functions.
Documentation scope: staleness works only from the paths, scripts, tags and deletions that Git and the manifests show; it does not compare prose with code behavior. Paraphrases that share little wording are not found as duplicates, nor are code examples that share only code; a translation is not a duplicate. Sphinx and AsciiDoc includes are not followed, and MDX expressions are not evaluated. A code comment is judged with the code next to it, not against what the whole program does, so a comment that no longer matches its code is not found. Token counts are estimates at four bytes per token.
Probabilities: these are model judgments, not measured accuracy. JevGate complements linters, type checkers, tests and dedicated security scanners; it does not replace them.