Certain SAST scanners rely on frameworks, not just languages
so we should aim for properly detecting those when possible