Crypto-View
Scan a codebase for every use of cryptography, and see which algorithms a quantum computer breaks. The result is a CycloneDX 1.7 CBOM.
What is scanned
94 rules across Java, Python, JavaScript/TypeScript and Go, plus formats that carry cryptography in any language: PEM certificates and keys, SSH keys, JOSE algorithms and TLS configuration.
Each finding gives the file, the line, the algorithm and its parameters. Where an algorithm is selected at runtime, the finding says it could not be determined rather than guessing.
What the result means
RSA, ECDSA and ECDH are broken by a quantum computer, and a larger key does not help. AES-256 and the hash functions are weakened but not broken.
Key exchange is ranked first, because traffic recorded today can be decrypted once the algorithm falls. Signatures can be forged, but only from the point the attacker has the machine.
Scanning locally
The same engine as one self-contained file. It needs Python 3.9 and nothing else, and never contacts the network — so it can scan a private repository.
Add --json cbom.json for the CycloneDX 1.7 document, or
--fail-on high to fail a build.
Full reference.
Recent scans
| Repository | Commit | Posture | Score | Scanned |
|---|---|---|---|---|
| wultra/powerauth-crypto develop | dfb4ed9e96b0 |
48 to address | 34 | 7 hours ago |
| smallstep/certificates master | 3f006a5d3288 |
458 to address | 0 | 7 hours ago |
| Peergos/Peergos master | 8e2e3baf101d |
35 to address | 70 | 7 hours ago |
| panva/node-oidc-provider main | 1ed7795bea6c |
149 to address | 13 | 7 hours ago |
| Mastercard/client-encryption-java main | 680da5afbc45 |
21 to address | 58 | 7 hours ago |