documenso/documenso

Cryptographic posture

56 cryptographic locations: 7 quantum-vulnerable, 15 reduced-margin, 11 undetermined, 23 quantum-safe

2 establish keys, so traffic protected by them and recorded today becomes readable once the algorithm falls. 1 imported cryptographic library is listed separately. 2426 files analysed.

Quantum-vulnerable 7 Reduced margin 15 Could not be determined 11 Quantum-safe 23

To address	9
Key establishment	2
Inventory only	1
Total findings	57

What was analysed

Branch	`main`
Commit	`6a99b40cba6b1b52c11d605e76b2a6c333c7ba2e` fix: improve action auth flow for passwordless users (#3358)
Committed	2026-09-11 04:17 UTC
Scanned	2026-09-11 06:54 UTC 1 hour ago
Coverage	2426 files, 2114 javascript

Earlier scans of this repository

16 scans · compare any two

0 to 50 locations Quantum-vulnerable 1 → 7 (up 6) Reduced margin 12 → 15 (up 3) Could not be determined 9 → 11 (up 2) Quantum-safe 21 → 23 (up 2) The filled point is the scan you are reading.

Scanned	Commit	To address	Key establishment
1 hour ago this scan	`6a99b40cba6b` main	9	2
10 hours ago	`e1ad4a2c55b4` main	1	1	Compare
10 hours ago	`e1ad4a2c55b4` main	1	1	Compare
23 hours ago	`b97c22a6074d` main	1	1	Compare
1 day ago	`f0ab7c112e3c`	1	1	Compare
1 day ago	`f0ab7c112e3c`	1	1	Compare
1 day ago	`b97c22a6074d` main	1	1	Compare
1 day ago	`389390c88494` main	1	1	Compare
1 day ago	`389390c88494` main	1	1	Compare
1 day ago	`389390c88494` main	1	1	Compare
1 day ago	`389390c88494` main	1	1	Compare
3 days ago	`2cac63a000e2` main	1	1	Compare
3 days ago	`2cac63a000e2` main	1	1	Compare
5 days ago	`2cac63a000e2` main	1	1	Compare
11 days ago	`5082b475a0b7` main	1	1	Compare
11 days ago	`f0ab7c112e3c`	1	1	Compare

Every repository in this history is re-scanned weekly.

List of cryptographic assets

RSASSA-PKCS1v15 Quantum-vulnerable 4 places See details

Algorithm named in a setting

A setting whose name says it holds an algorithm, given a literal that names one: `withOaepPaddingDigestAlgorithm("SHA-512")`, `signatureAlgorithm = "SHA256withRSA"`, `"digestAlgorithm": "SHA-256"`. The algorithm never reaches a `getInstance()` in this file - it is carried to one somewhere else, often through configuration - so a scan that only reads the factories cannot see it at all.

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

packages/ee/server-only/signing/csc/algorithm-resolver.ts:316 signatureAlgorithm: 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' | 'ECDSA';
packages/ee/server-only/signing/csc/algorithm-resolver.ts:338 const signatureAlgorithm: 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' =
packages/ee/server-only/signing/csc/signers/capture-signer.ts:31 type SignatureAlgorithm = 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' | 'ECDSA';
packages/ee/server-only/signing/csc/signers/fifo-signer.ts:20 type SignatureAlgorithm = 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' | 'ECDSA';

config.algorithm-setting · CWE-327

ECDSA Quantum-vulnerable 1 place See details

Algorithm named in a setting

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

packages/ee/server-only/signing/csc/algorithm-resolver.ts:330 signatureAlgorithm: 'ECDSA',

config.algorithm-setting · CWE-327

RSA Quantum-vulnerable Recorded traffic 1 place See details

Private key committed to the repository

A PEM private-key block. The header names the algorithm where the format is the legacy one; for PKCS#8 the algorithm OID is read out of the DER. A private key in version control is a present-day incident before it is a quantum question.

A secret key is stored in this repository's files. Anyone who can read the repository can use it. This needs attention today, regardless of quantum computers.

What to do. Revoke and rotate the key, then keep key material out of the repository. Record the algorithm in the inventory.

apps/docs/content/docs/self-hosting/configuration/storage.mdx:440 -----BEGIN RSA PRIVATE KEY-----

pem.private-key · CWE-321, CWE-327

RSA2048-bit Quantum-vulnerable Recorded traffic 1 place See details

Classical key pair generated with Node crypto

`crypto.generateKeyPair()` or its synchronous form. The detector resolves the algorithm through a `promisify()` wrapper and through an import alias, both of which are common enough that missing them would leave real key generation unreported.

A quantum computer of sufficient size breaks this completely. It has to be replaced, not tuned. Broken by Shor's algorithm on a cryptographically relevant quantum computer.

What to do. ML-KEM-768 for encryption, ML-DSA-65 for signatures. Node exposes neither yet, so this usually means an addon or a service boundary.

packages/ee/server-only/lib/create-email-domain.ts:89 const { publicKey, privateKey } = await generateKeyPairAsync('rsa', {

js.generatekeypair · CWE-327

SHA-256 Reduced margin 2 places See details

Algorithm named in a setting

Something here is configured to use a named algorithm. The code that uses it may be somewhere else entirely, but this is the line that decides which algorithm it is.

What to do. Find what consumes the setting. The migration belongs to that operation; this line is where the choice is actually written down, and usually where it is easiest to change.

packages/ee/server-only/signing/csc/signers/capture-signer.ts:27 type DigestAlgorithm = 'SHA-256' | 'SHA-384' | 'SHA-512';
packages/ee/server-only/signing/csc/signers/fifo-signer.ts:16 type DigestAlgorithm = 'SHA-256' | 'SHA-384' | 'SHA-512';

config.algorithm-setting · CWE-327

unknown Could not be determined 1 place See details

Cryptographic library in the dependency manifest

A dependency known to implement classical asymmetric cryptography. Its presence is inventory, not a finding about this codebase: the library may never be called with a quantum-vulnerable algorithm.

The project depends on a cryptography library. Listed so the inventory is complete; it is not by itself a problem.

What to do. Check the version. Several of these libraries have shipped ML-KEM and ML-DSA support since 2024, so the migration may need an upgrade rather than a replacement.

packages/lib/package.json:52 "jose": "^6.1.2",

dep.crypto-library

CSPRNG Quantum-safe 8 places See details

Random number generation

`crypto.randomBytes()`, `randomUUID()` or `getRandomValues()`. A platform CSPRNG is not a quantum exposure; it is recorded because an inventory that omits the randomness source is incomplete. `Math.random()` is a separate, present-day defect.

This is where the software gets its random numbers. Quantum computers do not weaken it.

What to do. No action.

apps/remix/server/security-headers.ts:59 crypto.getRandomValues(buf);
packages/auth/server/lib/session/session.ts:31 crypto.getRandomValues(bytes);
packages/ee/server-only/lib/send-organisation-account-link-confirmation-email.ts:61 const token = crypto.randomBytes(20).toString('hex');
packages/lib/jobs/definitions/emails/send-admin-user-created-email.handler.ts:33 token: crypto.randomBytes(18).toString('hex'),
packages/lib/server-only/2fa/setup-2fa.ts:23 const secret = crypto.randomBytes(10);
packages/lib/server-only/analytics/capture-server-event.ts:73 distinctId: userId ? String(userId) : `anon_${crypto.randomUUID()}`,
packages/lib/server-only/user/forgot-password.ts:21 const token = crypto.randomBytes(18).toString('hex');
packages/lib/server-only/user/send-confirmation-token.ts:13 const token = crypto.randomBytes(20).toString('hex');

js.rng

bcrypt Quantum-safe Renamed import 3 places See details

Password hashing or key derivation

A password hashing or key derivation function. Not a quantum exposure, and part of the inventory: a cryptographic bill of materials that omits how passwords are stored is not complete.

This is how passwords are stored. Quantum computers do not meaningfully weaken it.

What to do. Argon2id for new work. PBKDF2 needs a high iteration count to stay defensible.

packages/lib/server-only/auth/hash.ts:10 return bcryptHashSync(password, SALT_ROUNDS);
packages/prisma/seed/organisations.ts:48 password: hashSync('password'),
packages/prisma/seed/users.ts:44 password: hashSync(password),

js.kdf

HMAC Quantum-safe 1 place See details

JWT signed with a classical algorithm

A JOSE `alg` value. RS*, PS*, ES* and EdDSA sign with a quantum-vulnerable key; HS* is an HMAC and is not affected. `alg: 'none'` is reported as a critical defect today.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

packages/lib/server-only/embedding-presign/create-embedding-presign-token.ts:46 .setProtectedHeader({ alg: 'HS256' })

js.jwt.algorithm · CWE-327

HMAC Quantum-safe 1 place See details

JOSE algorithm declared in configuration

An `alg` value in JSON or YAML. `none` is reported as a critical defect; HS* is an HMAC and is not quantum-vulnerable; RS*, PS*, ES* and EdDSA are.

No known quantum attack changes how strong this is. A keyed MAC is not affected by Shor and only marginally by Grover.

What to do. No standardised post-quantum JOSE algorithm exists yet. Keep token lifetimes short.

packages/lib/server-only/embedding-presign/create-embedding-presign-token.ts:46 .setProtectedHeader({ alg: 'HS256' })

jose.algorithm · CWE-327

SHA-512 Quantum-safe 1 place See details

Hash function in use

`createHash()` or `subtle.digest()`. The digest is read from the argument, so one rule covers the family: MD5 and SHA-1 are reported as broken, SHA-256 as a reduced margin, SHA-384 and above as inventory.

No known quantum attack changes how strong this is. No known quantum algorithm changes the security margin.

What to do. SHA-256 as the floor, SHA-384 where the digest protects something long-lived.

packages/lib/server-only/auth/hash.ts:18 return crypto.createHash('sha512').update(input).digest('hex');

js.hash · CWE-328

Cryptographic assets

Algorithm	Assessment	What it means	Occurrences
`SHA-256`	Reduced margin	Pre-image resistance falls to about 128 bits of quantum work. Adequate for most uses; SHA-384 restores the full margin where a signature must last decades.	15
`unknown`	Could not be determined	The algorithm could not be established from the source - chosen at runtime, or decided somewhere this scan does not reach.	11
`bcrypt`	Quantum-safe	A password hashing function. Grover offers only a marginal speed-up against a deliberately slow function, so quantum computing is not the concern here.	9
`CSPRNG`	Quantum-safe	A cryptographically secure random number generator provided by the platform. Not weakened by a quantum computer.	8
`RSASSA-PKCS1v15`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer. The v1.5 signature scheme of RFC 8017 section 8.2 has no classical break of its own; RSA-PSS is preferred for new work, but the quantum exposure is the same for both.	4
`ChaCha20-Poly1305`	Quantum-safe	No known quantum algorithm changes the security margin.	3
`RSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	2
`HMAC`	Quantum-safe	A keyed MAC is not affected by Shor and only marginally by Grover.	2
`ECDSA`	Quantum-vulnerable	Broken by Shor's algorithm on a cryptographically relevant quantum computer.	1
`SHA-512`	Quantum-safe	No known quantum algorithm changes the security margin.	1

Imported cryptographic libraries

Library	Files
oslo hashing, JWT and OTP helpers	12
crypto the Node crypto module	11
@node-rs/bcrypt password hashing	6
@noble/ciphers symmetric encryption	3