Crypto-View
Scan a codebase to find every use of cryptography. See which components can be broken by a quantum computer. The result is a CycloneDX 1.7 CBOM.
What is scanned
94 rules across Java, Python, JavaScript/TypeScript and Go, plus formats that carry cryptography in any language: PEM certificates and keys, SSH keys, JOSE algorithms and TLS configuration.
Each finding gives the file, the line, the algorithm and its parameters. When the algorithm is chosen while the program runs, the finding says so instead of guessing.
What the result means
RSA, ECDSA and ECDH are broken by a quantum computer. A larger key does not help. AES-256 and the hash functions are weakened, but not broken.
Key exchange comes first. Traffic recorded today can be decrypted once the algorithm falls. Signatures can be forged too, but only from the moment an attacker has the machine.
Scanning locally
The same engine in a single file. It needs Python 3.9 and nothing else. It never uses the network, so it can scan a private repository.
Add --json cbom.json for the CycloneDX 1.7 document, or
--fail-on "hndl posture=vulnerable" to fail a build on
quantum-vulnerable key establishment.
Full reference.
Run it on every pull request
Crypto-View is published in the GitHub Marketplace. Three lines of YAML put the findings on the pull request. You decide which ones fail the build.
Recent scans
| Repository | Commit | Posture | Score | Scanned |
|---|---|---|---|---|
| wultra/powerauth-crypto develop | a7feb60d85dc |
48 to address | 34 | 2 hours ago |
| vlayer-xyz/vlayer-docs-2.0 main | be8fcecab84b |
Nothing found | 100 | 2 hours ago |
| smallstep/certificates master | bb481fbf670c |
458 to address | 0 | 2 hours ago |
| Peergos/Peergos master | 810190f8cf0f |
35 to address | 70 | 2 hours ago |
| panva/node-oidc-provider main | 8a5917001cbe |
149 to address | 13 | 2 hours ago |