There's no reason you couldn't also pledge an HTTP server written in a safe language too. One key thing to keep in mind is that exploit mitigations are largely

There's no reason you couldn't also pledge an HTTP server written in a safe language too. One key thing to keep in mind is that exploit mitigations are largely about limiting degrees of freedom. It's quite hard to contain an attacker who has gained code execution in a process (such as due to memory corruption) due to the massive amount of control they have. On the other hand, if you're able to prevent them from gaining such a strong foothold to begin with (such as by using safer languages which don't have such issues), you're in a much better spot because now they don't even gain any control over the process.