qScan

Find quantum-vulnerable cryptography in any codebase

A static scanner that walks your source (14 languages), dependency manifests, and infrastructure config for classical asymmetric crypto (RSA, ECDH, ECDSA, EdDSA, DH, and more) plus TLS, PKI, key material, and code-signing surfaces, then scores where harvest-now-decrypt-later exposure is highest.

Install

One command, no account, no upload

qScan runs locally. Your source never leaves the machine, and there is nothing to sign up for.

npx @quantakrypto/qscan ./

Source and issues on GitHub and on npm. Apache-2.0.

What it finds

Code, dependencies, and the platform around them

A source-only scan misses the surfaces you cannot fix in hindsight.

14 source languages + cloud/IaC, TLS, PKI & signing config
Crypto inventory + 0–100 readiness score, HNDL ranking
Vulnerable-dependency database across 7 ecosystems
SARIF, JSON, CycloneDX CBOM, ISO A.8.24 evidence & OpenVEX output
BYOK LLM triage + qremediate codemods (diff / apply / draft-PR)

The infrastructure surfaces are covered in more depth on the infrastructure page, and the inventory it produces is explained in the cryptographic inventory guide.

Output

Five report formats, all of them machine-readable

A finding that cannot leave the tool is a finding nobody acts on.

CycloneDX CBOM

A machine-readable cryptographic bill of materials, the inventory every migration plan starts from.

SARIF

Drops straight into GitHub code scanning, so findings appear as annotations on the PR.

JSON

The full finding set, for your own pipeline.

ISO 27001 A.8.24 evidence

The cryptography control, written as an evidence report an auditor accepts.

OpenVEX

Exploitability assertions, so a flagged component you have already assessed stays assessed.

The CBOM format itself is documented on the CycloneDX CBOM standards page.

Alternatives

How qScan compares

Written to be useful rather than flattering. Two of these are better than qScan at things qScan does not do.

Tool	What it is for	Licence
qScan	Source, dependencies and infrastructure config in one pass, scored and ranked by harvest-now-decrypt-later exposure.	Apache-2.0
pqcscan	Probes TLS and SSH endpoints and reports the algorithms they negotiate. A prober, not a source scanner.	Open source
IBM CBOMkit	Generates a CBOM from source, strongest on Java. No infrastructure surfaces, no HNDL ranking.	Apache-2.0
sonar-cryptography	A SonarQube plugin, so it inherits Sonar's language coverage and its setup cost.	Open source

If you need live endpoints rather than source, use the post-quantum TLS checker or qProbe.

PQC readiness auditInventory your cryptography and rank the harvest-now-decrypt-later exposure.Book an audit Migration engineeringPlan and execute the move to post-quantum algorithms without breaking production.Plan a migration

qScan

A scan finds it. An audit tells you what to do about it.

qScan is the same scanner our own engagements start from. The audit is the cryptographer reading the output.

Talk to us