CI guides

The practical hunt for RSA, Diffie–Hellman, and elliptic-curve schemes across source, dependencies, certificates, and live traffic: what actually counts as vulnerable, the detection methods, their blind spots, and how findings converge into one machine-readable inventory.

Regulators publish dated deadlines for retiring classical cryptography; most CI gates only catch new findings. How a policy-as-code mandate gate evaluates your whole estate against CNSA 2.0 or NIST IR 8547's calendar (warning after the deprecate date, failing after the disallow date), and why a regulatory deadline cannot be baselined away.