Discover cryptographic usage. Plan your next steps.
QuantumSafe Scanner by Evolext identifies supported source API usage and recognized local dependency declarations. A scoped review can connect those findings to your system context and post-quantum migration priorities.
Local v0.2.0 prototype · public downloads unavailable
Customer distribution awaits release verification and approved distribution terms. You can review the sample and discuss an assessment scope.
For SaaS engineering teams and SMEs with custom applications that need a bounded starting point for quantum-readiness planning. Agree authorization, supported languages, and evidence handling before scanning.
What v0.2.0 discovers
Go, Python, JavaScript, TypeScript, Java, and C#
Reviewed cryptographic API usage in supported source files, using file-local analysis.
Recognized direct local dependency declarations by default; selected local lockfile evidence is optional.
Console, JSON schema v2, and SARIF 2.1.0 reports with coverage and warning details.
From local evidence to a decision
1
Agree the boundary
Name the repository owner, authorize the scope, and define how evidence will be handled.
2
Run locally
Use an approved executable in your environment. The scanner does not compile or execute customer code.
3
Review the evidence
Check findings, warnings, and incomplete coverage. Confirm usage and context with the system owner.
4
Plan the next action
Gather missing evidence and prioritize a readiness assessment or controlled laboratory prototype.
Synthetic laboratory sample · not a customer resultv0.2.0 / JSON schema v2
Observed evidence High severity
RSA usage
Crypto.cs · Line 8
Recorded observationcall System.Security.Cryptography.RSA.Createdirect-api-usage
Rule
QS1001
Algorithm
RSA-2048
Detection confidence
0.99
Confidence describes the detection, not the probability that a deployed system is unsafe.
[01] Why it matters
This observation starts a review of public-key cryptography. Its purpose and the surrounding protocol determine which migration questions to ask.
[02] What remains unknown
Source presence does not establish deployed use, data confidentiality lifetime, or provider support. Human review must confirm the system context before choosing a change.
Read the original scanner recommendation
Original report text
RSA usage detected
Determine whether this RSA use provides key establishment, encryption, signatures, or another function. Assess ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures only after confirming protocol and provider support.
This excerpt comes from the included six-language sample report. Complete coverage means its supported candidate inputs were analyzed; it does not mean a complete system inventory.
Implementation level: local v0.2.0 prototype and synthetic fixtures. Knowledge reviewed: 8 August 2026; storefront reviewed: 11 October 2026. NIST FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) are algorithm reference standards, not certification of this scanner or your software. Source detection does not establish deployed usage or successful PQC negotiation.
The scanner itself has no runtime networking or telemetry and does not execute customer code. Reports include relative file names and cryptographic metadata: treat them as sensitive. This website does not accept repositories or report uploads. Inquiry details have separate Supabase storage and possible LINE notification handling.
No runtime, network, certificate, configuration, binary, or cloud scanning.
No complete dependency graph, CVE analysis, SBOM, or CBOM.
File-local analysis can miss wrappers, dynamic usage, unsupported syntax, and unknown packages.
A scan does not prove quantum safety, security, compliance, reachability, or cryptographic correctness.
The scanner finds evidence; an assessment adds context
Business ownership, data retention, vendor readiness, and migration feasibility require separate supplied evidence and human review. A scoped engagement can produce reviewed findings, evidence gaps, and prioritized follow-up actions.
