Languages and frameworks: see the support table. C, C++, Kotlin, Swift, Bash, Dart, Scala, Elixir and Lua have generic support, in preview: no hardcoded-value, security or test questions, and no callers from other files. Astro, Vue and Svelte markup is not read, only their scripts. PHP’s inline HTML is read only for its <?= … ?> echoes, and variables a page gets from the files it includes are not followed there: they are judged where those files set them.
Security scope: one function plus at most one hop of callers. This is not whole-program data-flow analysis. Access control reads the final state of policies, SECURITY DEFINER functions and grants across a project’s SQL files in path order, leaving out uninstall, teardown, rollback and down scripts; with --base, unchanged migrations are read for that state but not judged. It does not judge application-level authorization or dynamic SQL inside database functions.
Documentation scope: staleness works only from the paths, scripts, tags and deletions that Git and the manifests show; it does not compare prose with code behavior. Paraphrases that share little wording are not found as duplicates, nor are code examples that share only code; a translation is not a duplicate. Sphinx and AsciiDoc includes are not followed, and MDX expressions are not evaluated. A code comment is judged with the code next to it, not against what the whole program does, so a comment that no longer matches its code is not found. Token counts are estimates at four bytes per token.
What a change touches: with --base, a unit is judged when the change added or modified one of its lines, or removed lines between two of them. Lines removed just above or below a unit, such as a decorator over a function, do not count, since without the old file they belong as much to the code beside it. A change elsewhere that alters a unit’s evidence, such as a function it calls, a caller or an error class, does not judge the unit again, and copies are looked for among the changed files, so code a change copies from a file it left alone is not found. --whole-files judges every unit of each changed file.
Probabilities and precision: a probability says how sure one answer was, not how often such findings are right. The precision each finding shows comes from findings labeled from the code on the 25 projects JevGate was never tuned on, so it estimates how often it is right on code like theirs; below 20 labels it is not yet measured. Accuracy gives it for every rule and level. JevGate complements linters, type checkers, tests and dedicated security scanners; it does not replace them.