Programming Language Market Share 2026: Seven Indexes Compared

Python is the most popular programming language in 2026 by the most measures, but not by all of them. In October 2026 it leads TIOBE at 19.23% and PYPL at 53.9%, and it led IEEE Spectrum's 2025 ranking. JavaScript leads Stack Overflow's 2025 survey and RedMonk's January 2026 ranking, and TypeScript leads GitHub's contributor count.

There is no single market share number for programming languages. Each index picks a proxy (search hits, tutorial searches, GitHub activity, forum tags, survey answers) and the proxy decides the winner. Below we compare seven rankings, explain why they disagree, and show how to turn them into ecosystem coverage requirements for security tooling.

Key takeaways

• Python is first in three of the seven indexes. It leads TIOBE (October 2026), PYPL (October 2026) and IEEE Spectrum (2025, default and Jobs rankings), and it tops our own composite. It is second on GitHub and in RedMonk, and fourth in the Stack Overflow survey once HTML/CSS and SQL are counted.
• JavaScript wins where developers report or discuss what they use. It is first in the Stack Overflow 2025 survey (66% of respondents) and in RedMonk's January 2026 ranking, but sixth in TIOBE, sixth in PYPL and sixth in IEEE Spectrum's 2025 default ranking.
• TypeScript wins where code is committed. GitHub's Octoverse 2025 counted 2,636,006 monthly contributors in TypeScript in August 2025, about 42,000 more than Python, the first time TypeScript led. It does not appear in TIOBE's top 20 at all.
• C and C++ look huge in search based indexes and small in package data. TIOBE puts C second and C++ third; RedMonk puts them seventh (C++) and tenth (C). Neither has a central package registry, which matters for security tooling.
• The October 2026 TIOBE index is not directly comparable with earlier months. TIOBE added Mandarin Chinese search terms this month, weighted at 44.2% of English terms, and says its long term history is temporarily unavailable while it rebuilds it.
• AI assistants are bending every public signal. IEEE Spectrum reports that Stack Exchange question volume in 2025 was about 22% of 2024 levels, and RedMonk now questions whether Stack Overflow should stay one of its two axes.
• For security, use the indexes to sanity check coverage, then measure your own estate. Your manifests and lockfiles, not a global ranking, decide which ecosystems your scanner and fix pipeline must handle well.

The answer by index, in one table

Every figure below was read on the index's own page on 23 October 2026, except where the cell says otherwise.

No language is first everywhere. Indexes that read the open web (TIOBE, PYPL) favour older, teaching heavy and systems languages such as C, C++ and Java; indexes that read code and developers (GitHub, Stack Overflow, RedMonk) favour the web stack. TypeScript swings from first to outside the top 20, the biggest disagreement in the set.

What does TIOBE measure, and what changed in October 2026?

TIOBE counts how many web pages talk about a language. Its page says the ratings reflect "the number of skilled engineers world-wide, courses and third party vendors", estimated by querying Google, Amazon, Wikipedia, Bing and more than 20 other popular sites. The query is essentially +"<language> programming". To qualify, a language must be Turing complete, have its own Wikipedia entry that identifies it as a programming language, and return more than 5,000 Google hits for that query. Where a language has several search terms, TIOBE takes the highest rating rather than the sum. The index updates monthly.

The October 2026 top ten, read from tiobe.com on 23 October 2026:

Places 11 to 20 are Go (1.39%), PHP (1.26%), Fortran (1.12%), Swift (1.03%), Scratch (0.97%), COBOL (0.89%), Perl (0.88%), Julia (0.88%), Delphi/Object Pascal (0.83%) and MATLAB (0.83%). TIOBE's headline for the month is Julia returning to the top 20 for the first time in three years. TypeScript, Kotlin, Ruby and shell scripting are not in the top 20.

The methodology change. TIOBE says it has added Mandarin Chinese search terms, querying "编程" (programming) in addition to the English word, and that Chinese terms carry 44.2% of the weight of English terms. It also says long term historical data is temporarily unavailable while it restores it after the change. So October 2026 ratings are not cleanly comparable with September's, and the year on year column straddles the change too: Python's minus 5.23 points and C#'s minus 3.15 points may mix real movement with method effects. TIOBE's page does not say whether October 2025 was recomputed, so we do not read those deltas as pure trend.

Figures we could not verify. Press coverage reported a September 2026 Python rating of 17.76% and a C++ to Java gap of 0.37 points in August and 1.13 in September. TIOBE's page shows only the current month and the press article would not load, so we do not rely on them. From TIOBE's October table, C++ (8.87%) leads Java (8.41%) by 0.46 points.

How does PYPL differ from TIOBE, and why is its Python figure so high?

PYPL (PopularitY of Programming Language) counts something narrower: how often people search Google for a language tutorial. Its FAQ says it exports Google Trends data, computes each language's tutorial interest relative to Java tutorials each month, normalises the total to 100%, and smooths over six months. The authors describe tutorial searches as a "leading indicator", which is a fair way to put it. PYPL measures learning intent, not usage.

The PYPL page renders its table in the browser, so we read the data file behind the chart (pypl.github.io/PYPL/All.js). Its latest row is dated 1 October 2026 and sums to 100%. The rendered table could round differently.

Further down, Go sits at 0.53% (1.29% a year earlier) and Kotlin at 0.45% (1.37%).

Why Python is at 53.9%. PYPL is a share of a shrinking pie. If developers stop searching for tutorials because a coding assistant answers inline, other languages' tutorial searches fall and Python's share rises even if nobody new starts learning it. In October 2026 almost every language except Python and Objective-C lost share, which fits that pattern, with Python (the default first language for data and AI courses) declining least. That is our explanation, not a PYPL finding. Objective-C rising to fifth, ahead of JavaScript, is a reminder that small absolute search volumes can produce odd shares.

Where PYPL figures disagree. Secondary sites quote very different 2026 Python figures: 34.87% (March), 40.9% (April), 50.00% (August), 52.1% (September). We read the data file only for October 2026 and October 2025, so treat those as unconfirmed.

How does RedMonk combine GitHub and Stack Overflow, and why was January 2026 late?

RedMonk ranks languages by plotting two signals against each other: pull request activity on GitHub and tag counts on Stack Overflow. Stephen O'Grady's post of 14 April 2026 explains the GitHub side: data comes from the GitHub Archive, querying pull requests by language, with language taken from the base repository and forks excluded. The Stack Overflow side uses its data explorer. A language must appear in both to be ranked. RedMonk says plainly that the ranking is meant to show correlation between code and discussion as a signal of future adoption, not a statistically valid picture of current usage. It publishes a rank, not a share.

The January 2026 top 20:

C# moved from fifth to tie PHP at fourth; O'Grady writes that he cannot tell whether C# gained or PHP fell. Objective-C has declined steadily since Swift arrived and may leave the top 20.

Why it published in April. O'Grady calls the edition "three months late or two months early" and cites unresolved data anomalies. Coding assistants have reduced Stack Overflow's relevance, so its tags represent developers less well and may not stay one of the two axes. On GitHub, pull request volume in the second half of the period was unusually low, possibly a data gap or less code going to public repositories. He sees no meaningful AI driven shift in language usage yet.

What do IEEE Spectrum's rankings show, and why did JavaScript fall to sixth?

IEEE Spectrum publishes an interactive ranking built from several public signals. Its 2025 article, published 23 September 2025, names Google search traffic, Stack Exchange questions, mentions in research papers and GitHub open source activity among them, "and so on", so the full source list is not in the article text. The default "Spectrum" ranking is weighted toward the interests of IEEE members. A separate "Jobs" ranking looks only at what employers ask for.

What we could verify from the article:

• Python is first in the default Spectrum ranking.
• Python is also first in the Jobs ranking, up from second the year before, and the article stresses that SQL remains a very valuable skill on a CV.
• JavaScript dropped from third to sixth in the default ranking, the largest change in the top five. The author suggests AI is a factor, since JavaScript is the language of web pages and a lot of AI assisted "vibe coding" produces websites.
• Stack Exchange question volume in 2025 was about 22% of its 2024 level across the languages evaluated.

We could not verify the full top ten of either ranking: the interactive table did not render and secondary summaries disagree on C and C++, so we left those cells blank. We found no 2026 edition as of 23 October 2026.

The wider point applies to every index here: as programmers ask private chat assistants instead of public forums, the public signals rankings rely on thin out.

Why did GitHub's Octoverse put TypeScript first?

GitHub counts people, not pages. The Octoverse 2025 report, published 28 October 2025, ranks languages by the number of distinct contributors who committed code in that language in a month. Year on year comparisons use August 2025 against August 2024. Unless stated otherwise the metrics cover public activity only.

The top five by contributors were TypeScript, Python, JavaScript, Java and C#. PHP, Shell, C++, HCL and Go also appear in the top ten chart, but the article text does not give their order, so we have not ranked them. GitHub says more than 180 million developers now use the platform.

Why does this differ from the surveys?

1. TypeScript and JavaScript share one ecosystem. Our reading, not a GitHub finding: a developer who would have committed JavaScript a few years ago increasingly commits TypeScript, while survey respondents who use both still tick JavaScript. GitHub itself notes that JavaScript and TypeScript together still account for more activity than Python alone.
2. AI generated repositories add contributors fast. GitHub's own headline credits AI with leading TypeScript to first place.
3. Public only. Enterprise code in private repositories is invisible. GitHub states that other indexes use different methods and may still rank JavaScript and Python higher.

What does the Stack Overflow 2025 survey say about usage versus admiration?

The Stack Overflow survey is the largest self reported dataset. The press release (29 July 2025) says more than 49,000 developers in 177 countries responded. The language question was answered by 31,771 people. Respondents tick every language they used extensively in the past year, so percentages add up to far more than 100%.

Python's use rose 7 percentage points from 2024 to 2025, the largest gain the press release calls out. Note the split between columns: Python is more common among all respondents than among professionals, while TypeScript is more common among professionals (48.8%, level with Bash/Shell) than among everyone. That is the learner effect again, the same one that inflates PYPL.

Admired is not used. The survey also asks which languages people want to keep using. Rust is the most admired language again at 72%, followed by Gleam (70%), Elixir (66%) and Zig (64%). Those admiration figures come from the survey's own technology page as surfaced in search results; the section was cut off in our direct fetch, so we have not confirmed the "desired" column at all. Admiration measures loyalty among people who already use a language. Rust can be the most admired language and still be used by fewer than one in six respondents.

What does JetBrains' 2025 survey say about growth potential?

JetBrains' State of Developer Ecosystem 2025 surveyed developers between April and June 2025. Its results page reports 24,534 respondents after data cleaning, with responses balanced by geography, employment, programming languages and JetBrains product use. It also says, to its credit, that "some bias may remain, as JetBrains users could have been more likely to respond." Secondary coverage puts the sample at 194 countries.

JetBrains' headline language metric is the Language Promise Index, which its tools and trends page says combines "growth stability, adoption momentum, and user loyalty" to estimate which languages are most likely to expand over the coming year. The page does not publish weights or a formula, and the ranked chart did not render in our fetch, so the order below comes from press coverage of the report.

The JetBrains view is forward looking, and also the most exposed to audience bias, as JetBrains itself acknowledges.

Where do the indexes agree, and where do they disagree most?

To compare like with like we turned each index into a rank and put the four that publish a full ordering side by side: TIOBE (October 2026), PYPL (October 2026), RedMonk (January 2026) and Stack Overflow (2025, all respondents, including HTML/CSS and SQL in the ordering). GitHub and IEEE are shown where their published text gives a position.

Where they agree. Python is in the top four of every ranking, and top two in five of the six that rank it. Java is in the top seven of every full ranking. Go, Rust and Kotlin are mid table everywhere.

Where they disagree most.

• TypeScript: first on GitHub, sixth in RedMonk and Stack Overflow, twelfth in PYPL, outside TIOBE's top 20. Search based indexes undercount it because people search and write about it as JavaScript; code based indexes see it directly.
• C: second in TIOBE, tenth or lower in code and survey indexes. C has an enormous written footprint (textbooks, embedded systems documentation, vendor material) relative to the number of developers who say they use it each year.
• Rust: tenth in TIOBE and eighth in PYPL, but twentieth in RedMonk. Interest and learning outrun committed public code.

Our composite ranking

If you need one list, here is a composite. This is our own calculation, not a published index. We took the median of each language's rank across the four full orderings (TIOBE, PYPL, RedMonk, Stack Overflow). Where a language falls outside a published list we treat it as ranking below the last listed position. Ruby, SQL and Shell are left out because two of the four indexes do not rank them, so a median would be meaningless. The bar is a visual aid only.

Two warnings. Search based indexes are half the inputs, which flatters C and C++ and penalises TypeScript. And a median of ranks hides magnitude: Python's 53.9% in PYPL and 19.23% in TIOBE are both just "1".

Which biases does each method carry?

None of these measures share of production code; no public dataset does.

How should a security team translate market share into coverage requirements?

A global ranking tells you which ecosystems any credible scanner must handle well. It does not tell you what is in your own estate. It also helps to look at a different axis: where known vulnerabilities are filed. The GitHub Advisory Database counts reviewed advisories by package ecosystem. We read these counts on 23 October 2026.

The page shows 37,118 reviewed advisories in total; the per ecosystem figures add up to more because one advisory can cover several ecosystems. For deeper per ecosystem numbers, our earlier note on checking your ecosystems against OSV coverage before choosing a scanner goes ecosystem by ecosystem.

Read the two rankings together and four practical rules fall out.

1. The big five package ecosystems are non negotiable. npm, Maven, PyPI, Composer and Go carry the large majority of reviewed advisories, and the languages behind them sit in the top half of every index. Any scanner, SBOM generator or fix pipeline you buy must be strong on all five, including lockfile parsing and transitive resolution.
2. PHP is a bigger security surface than its popularity suggests. It is twelfth in TIOBE but Composer is the fourth largest advisory ecosystem. JetBrains calls PHP mature and in long term decline, which in security terms often means old code that nobody wants to touch.
3. C and C++ need a different method. They are top five by search footprint but have no single registry, so manifest based scanning sees them only when they arrive as operating system packages, container layers, Conan or vcpkg manifests, or vendored source. Plan explicitly for container image scanning and for an inventory of vendored native code.
4. Rising languages need coverage before they need volume. Rust, Go and Kotlin are on a steady climb per JetBrains, and TypeScript leads GitHub. Check coverage for them now, not after the first incident.

How we measured

• Dates. All pages were read on 23 October 2026. Each figure carries the edition date the index gives (listed in the first table).
• Primary first. Every number comes from the index's own page except where we say otherwise. Two JetBrains findings (the Promise Index order and the want to adopt percentages) and the 194 country figure come from press coverage, because the JetBrains charts did not render in our fetch and its research blog refused the request. Stack Overflow admiration figures come from the survey's own page as shown in search results, because our direct fetch was truncated before that section.
• PYPL. The rendered page loads its table in the browser, so we read the published data file behind the chart and confirmed the latest row sums to 100%.
• Ranks. For Stack Overflow we ranked the full list including HTML/CSS and SQL, so Python appears fourth; among programming languages only, excluding markup, it would be third. For PYPL, C and C++ are one line, so both get rank 3.
• Composite. Median of four ranks, with languages outside a published list treated as ranking below its last position. It is ours, not an industry figure, and it is sensitive to which indexes you include.
• What we did not do. We did not average percentage shares across indexes, because they measure different units.

Walkthrough: measure your own language and ecosystem mix

The indexes tell you about the world. These steps tell you about your code. They use the GitHub CLI, git, jq and the OSV API; adapt the host commands for other source control systems.

1. Bytes per language for one repository. GitHub's REST API reports the number of bytes of code per language detected in a repository.

gh api repos/OWNER/REPO/languages

2. Roll it up across an organisation.

ORG=your-org
gh repo list "$ORG" --limit 1000 --json name -q '.[].name' |
while read -r repo; do
  gh api "repos/$ORG/$repo/languages"
done | jq -s 'reduce .[] as $r ({}; reduce ($r | to_entries[]) as $e (.; .[$e.key] += $e.value))
  | to_entries | sort_by(-.value) | .[:15]'

This gives you your own ranking by volume of code, which you can set beside the table above. It will almost certainly not match any public index.

3. Count package manifests and lockfiles, which is what scanners actually read.

git ls-files | grep -E '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|requirements[^/]*\.txt|poetry\.lock|uv\.lock|Pipfile\.lock|pom\.xml|build\.gradle(\.kts)?|gradle\.lockfile|go\.sum|Cargo\.lock|composer\.lock|Gemfile\.lock|packages\.lock\.json|[^/]*\.csproj)$' \
  | xargs -n1 basename | sort | uniq -c | sort -rn

A repository with package.json but no lockfile is a finding in itself: without a lockfile, the versions you test are not guaranteed to be the versions you ship.

4. Find native code that no package manager tracks.

git ls-files '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hpp' | wc -l
git ls-files | grep -E '(^|/)(conanfile\.(txt|py)|vcpkg\.json|CMakeLists\.txt|Makefile)$'

If the first number is large and the second shows no Conan or vcpkg manifest, you have vendored C or C++ that needs a manual inventory or a container level scan.

5. Spot check a package version against public advisory data. The OSV API answers "is this version affected?" for the major ecosystems.

curl -s -d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.20"}' \
  https://api.osv.dev/v1/query | jq '.vulns[].id'

6. Generate an inventory and vulnerability report for the whole repository. With the Safeguard CLI installed, scan the working directory, a container image or an existing SBOM; results are written as JSON under ./output.

safeguard scan --dir .
safeguard scan --image your-registry/your-app:latest
safeguard scan --sbom ./sbom.cdx.json

7. Compare and decide. Set your bytes per language (step 2), lockfile counts (step 3) and the advisory counts above side by side. Ecosystems high in all three are where scanner accuracy, reachability and automated fixes matter most. Ecosystems in step 3 that your current tool does not support are coverage gaps.

Common mistakes

• Quoting TIOBE as market share. It is a share of search engine hits for a phrase. It says nothing about how much production code exists in a language.
• Comparing October 2026 TIOBE with any earlier month as if nothing changed. The Mandarin search terms make the October figures a new series. Wait for TIOBE to restore and restate its history before drawing trend lines.
• Reading PYPL's 53.9% as "half of developers use Python". It is half of tutorial searches across the languages PYPL tracks, in a pie that is shrinking as assistants replace tutorials.
• Treating "most admired" as "most used". Rust is admired by 72% of the Stack Overflow respondents who use it, and used by 14.8% of all respondents.
• Averaging percentages across indexes. Search share, tutorial share, survey share and contributor counts are different units. If you must combine, combine ranks and say it is your composite.
• Ignoring C and C++ because package databases look small. They are small in package advisory data because there is no central registry, not because there is little code or few vulnerabilities.
• Buying tools for the global top ten instead of your estate. A Ruby and Elixir shop gains little from a scanner that is excellent at everything except RubyGems and Hex.

Fix it without waiting for upstream

Whichever index you trust, the top ecosystems are the ones where your teams will meet the most published vulnerabilities, and those are the ones where waiting for a maintainer costs most. Knowing your language mix is only useful if it shortens the time from advisory to fixed build.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

How this maps to the ecosystems in this post. Safeguard's dependency scanning (generally available) builds a full transitive inventory across npm, PyPI, Maven and Gradle, Go, Cargo, NuGet, Composer and Bundler, plus container image layers, and Griffin fix pull requests support JavaScript, Python, Java, Go, Rust, Ruby, .NET and PHP. That lines up with every language in the composite top ten except C, C++ and R. For C and C++, the realistic route is scanning the container images and operating system packages they ship in, plus a manual inventory of vendored source; we do not claim manifest level coverage for native code built from source without a package manager. Gold Open Source covers 20+ ecosystems, and the per package pages are the quickest way to confirm a safe version when an advisory lands. See also our developer survey analysis and SBOM driven incident response.

FAQ

What is the most popular programming language in 2026?

Python, by most measures: first in TIOBE (19.23%, October 2026), PYPL (53.9%, October 2026) and IEEE Spectrum 2025. JavaScript leads Stack Overflow 2025 and RedMonk January 2026; TypeScript leads GitHub by monthly contributors.

Is TypeScript more popular than Python now?

On GitHub, yes: in August 2025 TypeScript had 2,636,006 monthly contributors, about 42,000 more than Python, according to Octoverse 2025. In surveys and search based indexes, no. Stack Overflow's 2025 survey has Python at 57.9% and TypeScript at 43.6%, and TypeScript is outside TIOBE's top 20.

Why does TIOBE rank C second when few developers say they use it?

TIOBE counts search engine hits for "C programming", and C has decades of books, courses and vendor pages. Only 22% of Stack Overflow's 2025 respondents report using it.

What changed in the TIOBE index in October 2026?

TIOBE added Mandarin Chinese search terms, weighted at 44.2% of the English terms, and says its long term historical data is temporarily unavailable while it restores it. October 2026 figures should not be compared directly with earlier months.

Why is Python's PYPL share over 50%?

PYPL measures each language's share of Google searches for tutorials. Python rose from 29.43% a year earlier to 53.9% while almost every other language lost share, consistent with tutorial searches falling overall as assistants answer directly. It does not mean half of developers use Python.

Which programming language is the most loved or admired?

Rust, for another year. The Stack Overflow 2025 survey reports Rust as the most admired language at 72%, ahead of Gleam (70%), Elixir (66%) and Zig (64%). Admired means current users want to keep using it, not that it is widely used.

Which programming language ecosystem has the most security vulnerabilities?

By GitHub reviewed advisories on 23 October 2026, npm leads with 7,939, then Maven (7,193), pip (6,662), Composer (6,581) and Go (5,017). Raw counts reflect ecosystem size, age and reporting culture as much as language safety, and C and C++ do not appear because they have no central package registry.

How should I choose security tooling based on language popularity?

Use the indexes to confirm a tool covers the major ecosystems, then measure your own estate by bytes of code and lockfile counts and choose for what is large in your code.

See how Safeguard would help

This first demo is a real Safeguard CLI session: you install it, open the interactive terminal, ask it to fix the lodash CVE in a repository, and watch it read the finding and advisory, edit package.json to lodash 4.17.21, and run npm install and npm test only after you approve each command. The same flow applies to whichever ecosystem tops your own lockfile count, and it ends with /scan ..

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with a device code, and then scans from the terminal. It is a practical way to run step 6 of the walkthrough from your own machine across many repositories.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask questions such as which projects carry vulnerabilities in a given ecosystem and get answers from your own Safeguard data rather than from a global index.

Click through it at your own pace, or open it full screen.

To try it on your own code, download Safeguard and follow the CLI documentation.

Quick check

Sources

• TIOBE Index, October 2026
• PYPL PopularitY of Programming Language, method and FAQ
• PYPL data file behind the worldwide chart
• RedMonk Programming Language Rankings: January 2026 (14 April 2026)
• IEEE Spectrum, The Top Programming Languages 2025
• GitHub Octoverse 2025: a new developer joins GitHub every second as AI leads TypeScript to number one
• Stack Overflow Developer Survey 2025, Technology
• Stack Overflow 2025 Developer Survey press release
• JetBrains State of Developer Ecosystem 2025, results
• JetBrains State of Developer Ecosystem 2025, Tools and Trends
• heise online coverage of the JetBrains 2025 survey
• GitHub Advisory Database, reviewed advisories by ecosystem

Last reviewed: 23 October 2026. Index figures change monthly; check the linked pages for the latest editions.