It then provides examples of non-compliant and compliant code. "These detectors work with Java and Python code and, for Java, are not limited to the Log4j library," AWS notes.

But while security bugs were prevalent in JavaScript, Ruby, and Java, it was not in PHP and Python, where the vast majority of bugs were in the direct dependencies (primary components).