{
  "scanner": {
    "name": "QuantumSafe Scanner by Evolext",
    "version": "0.2.0",
    "rulesetVersion": "multilang-2026.1",
    "knowledgeBaseVersion": "nist-2026.2",
    "knowledgeLastReviewed": "2026-08-08",
    "parserCatalogVersion": "parsers-2026.1",
    "dependencyCatalogVersion": "crypto-packages-2026.1",
    "schemaVersion": "2.0.0"
  },
  "repository": {
    "name": "mixed-language",
    "languages": [
      "csharp",
      "go",
      "java",
      "javascript",
      "python",
      "typescript"
    ],
    "dependencyMode": "direct"
  },
  "coverage": {
    "complete": true,
    "regularFilesVisited": 11,
    "candidates": 11,
    "filesAnalyzed": 11,
    "filesSkipped": 0,
    "candidatesByLanguage": [
      {
        "name": "csharp",
        "count": 2
      },
      {
        "name": "go",
        "count": 2
      },
      {
        "name": "java",
        "count": 2
      },
      {
        "name": "javascript",
        "count": 2
      },
      {
        "name": "python",
        "count": 2
      },
      {
        "name": "typescript",
        "count": 1
      }
    ],
    "analyzedByLanguage": [
      {
        "name": "csharp",
        "count": 2
      },
      {
        "name": "go",
        "count": 2
      },
      {
        "name": "java",
        "count": 2
      },
      {
        "name": "javascript",
        "count": 2
      },
      {
        "name": "python",
        "count": 2
      },
      {
        "name": "typescript",
        "count": 1
      }
    ],
    "skippedByLanguage": [],
    "candidatesByArtifactKind": [
      {
        "name": "manifest",
        "count": 5
      },
      {
        "name": "source",
        "count": 6
      }
    ],
    "analyzedByArtifactKind": [
      {
        "name": "manifest",
        "count": 5
      },
      {
        "name": "source",
        "count": 6
      }
    ],
    "skippedByArtifactKind": [],
    "skippedByReason": []
  },
  "summary": {
    "detected": 18,
    "reported": 18,
    "bySeverity": [
      {
        "name": "high",
        "count": 6
      },
      {
        "name": "informational",
        "count": 10
      },
      {
        "name": "low",
        "count": 1
      },
      {
        "name": "medium",
        "count": 1
      }
    ],
    "byQuantumRisk": [
      {
        "name": "context-dependent",
        "count": 1
      },
      {
        "name": "post-quantum",
        "count": 1
      },
      {
        "name": "quantum-vulnerable",
        "count": 5
      },
      {
        "name": "quantum-weakened",
        "count": 4
      },
      {
        "name": "review-required",
        "count": 2
      },
      {
        "name": "unknown",
        "count": 5
      }
    ],
    "byClassicalRisk": [
      {
        "name": "context-dependent",
        "count": 8
      },
      {
        "name": "no-known-weakness",
        "count": 2
      },
      {
        "name": "unknown",
        "count": 6
      },
      {
        "name": "weak",
        "count": 2
      }
    ],
    "byLanguage": [
      {
        "name": "csharp",
        "count": 4
      },
      {
        "name": "go",
        "count": 2
      },
      {
        "name": "java",
        "count": 4
      },
      {
        "name": "javascript",
        "count": 3
      },
      {
        "name": "python",
        "count": 3
      },
      {
        "name": "typescript",
        "count": 2
      }
    ],
    "byArtifactKind": [
      {
        "name": "manifest",
        "count": 5
      },
      {
        "name": "source",
        "count": 13
      }
    ]
  },
  "algorithmInventory": [
    {
      "family": "AES",
      "variant": "AES",
      "count": 1
    },
    {
      "family": "CSPRNG",
      "count": 1
    },
    {
      "family": "DH",
      "variant": "finite-field",
      "count": 1
    },
    {
      "family": "EdDSA",
      "variant": "Ed25519",
      "count": 1
    },
    {
      "family": "MAC",
      "variant": "SHA-256",
      "count": 1
    },
    {
      "family": "ML-KEM",
      "variant": "ML-KEM",
      "count": 1
    },
    {
      "family": "RSA",
      "variant": "RSA",
      "count": 1
    },
    {
      "family": "RSA",
      "variant": "RSA-2048",
      "count": 2
    },
    {
      "family": "SHA-1",
      "variant": "SHA-1",
      "count": 1
    },
    {
      "family": "SHA-256",
      "variant": "SHA-256",
      "count": 2
    },
    {
      "family": "TLS",
      "variant": "certificate-verification-disabled",
      "count": 1
    }
  ],
  "dependencyInventory": [
    {
      "ecosystem": "gomod",
      "package": "golang.org/x/crypto",
      "relationship": "direct",
      "count": 1
    },
    {
      "ecosystem": "maven",
      "package": "org.bouncycastle:bcprov-jdk18on",
      "relationship": "direct",
      "count": 1
    },
    {
      "ecosystem": "npm",
      "package": "jose",
      "relationship": "direct",
      "count": 1
    },
    {
      "ecosystem": "nuget",
      "package": "nsec.cryptography",
      "relationship": "direct",
      "count": 1
    },
    {
      "ecosystem": "pypi",
      "package": "cryptography",
      "relationship": "direct",
      "count": 1
    }
  ],
  "suppressionSummary": {
    "count": 0,
    "byRule": []
  },
  "warningSummary": [],
  "warnings": [],
  "findings": [
    {
      "id": "f5e8e448205706ef330b2f930c195daea23e9a5884412f1f937e6917087db9d8",
      "rule": {
        "id": "QS1001",
        "title": "RSA usage detected"
      },
      "file": "Crypto.cs",
      "region": {
        "startLine": 8,
        "startColumn": 13,
        "endLine": 8,
        "endColumn": 29
      },
      "artifact": {
        "kind": "source",
        "language": "csharp",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "RSA",
        "variant": "RSA-2048",
        "keySize": 2048
      },
      "api": "System.Security.Cryptography.RSA.Create",
      "purpose": "key-generation",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-vulnerable",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call System.Security.Cryptography.RSA.Create"
      },
      "recommendation": "Determine whether this RSA use provides key establishment, encryption, signatures, or another function. Assess ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures only after confirming protocol and provider support.",
      "references": [
        {
          "title": "NIST FIPS 203 — ML-KEM",
          "url": "https://csrc.nist.gov/pubs/fips/203/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 204 — ML-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/204/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 205 — SLH-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/205/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 186-5 — Digital Signature Standard",
          "url": "https://csrc.nist.gov/pubs/fips/186-5/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "41859816018ce300de614e6a72e628d925596b4d87395562db3c5b11d178cb98",
      "rule": {
        "id": "QS3001",
        "title": "AES usage detected"
      },
      "file": "Crypto.cs",
      "region": {
        "startLine": 9,
        "startColumn": 13,
        "endLine": 9,
        "endColumn": 25
      },
      "artifact": {
        "kind": "source",
        "language": "csharp",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "AES",
        "variant": "AES"
      },
      "api": "System.Security.Cryptography.Aes.Create",
      "purpose": "unknown",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-weakened",
      "migrationUrgency": "review",
      "severity": "low",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call System.Security.Cryptography.Aes.Create"
      },
      "recommendation": "Do not replace AES solely because of quantum planning. Verify key size, authenticated mode, nonce handling, and protocol context; an aes.NewCipher call alone does not establish secure use.",
      "references": [
        {
          "title": "NIST FIPS 197 — Advanced Encryption Standard",
          "url": "https://csrc.nist.gov/pubs/fips/197/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "3d34a1a4d9608ae1877b84037663379e1b8dd781bb2f61a55633a471e0946373",
      "rule": {
        "id": "QS6102",
        "title": "TLS certificate verification disabled"
      },
      "file": "Crypto.cs",
      "region": {
        "startLine": 11,
        "startColumn": 17,
        "endLine": 13,
        "endColumn": 2
      },
      "artifact": {
        "kind": "source",
        "language": "csharp",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "TLS",
        "variant": "certificate-verification-disabled"
      },
      "api": "csharp.tls-config.servercertificatecustomvalidationcallback",
      "purpose": "tls",
      "classicalRisk": "weak",
      "quantumRisk": "context-dependent",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "protocol-configuration",
        "symbol": "config csharp.tls-config.servercertificatecustomvalidationcallback"
      },
      "recommendation": "Restore certificate and hostname verification. If custom verification is required, use documented verification callbacks and test failure behavior instead of disabling verification globally.",
      "references": [
        {
          "title": "NIST SP 800-131A Rev. 2 — Cryptographic Transitions",
          "url": "https://csrc.nist.gov/pubs/sp/800/131/a/r2/final",
          "status": "final"
        }
      ]
    },
    {
      "id": "01b3ab445d6dbdcb659e76597ae3ca722480da609752a8a17f83e73caed39351",
      "rule": {
        "id": "QS1001",
        "title": "RSA usage detected"
      },
      "file": "Crypto.java",
      "region": {
        "startLine": 7,
        "startColumn": 5,
        "endLine": 7,
        "endColumn": 40
      },
      "artifact": {
        "kind": "source",
        "language": "java",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "RSA",
        "variant": "RSA"
      },
      "api": "java.security.KeyPairGenerator.getInstance",
      "purpose": "unknown",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-vulnerable",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call java.security.KeyPairGenerator.getInstance"
      },
      "recommendation": "Determine whether this RSA use provides key establishment, encryption, signatures, or another function. Assess ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures only after confirming protocol and provider support.",
      "references": [
        {
          "title": "NIST FIPS 203 — ML-KEM",
          "url": "https://csrc.nist.gov/pubs/fips/203/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 204 — ML-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/204/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 205 — SLH-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/205/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 186-5 — Digital Signature Standard",
          "url": "https://csrc.nist.gov/pubs/fips/186-5/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "9101f3252fd3134cb464ba7b13a6f3ad6d08056120a461dd88944f5ce64b5f85",
      "rule": {
        "id": "QS3003",
        "title": "SHA-256 usage detected"
      },
      "file": "Crypto.java",
      "region": {
        "startLine": 8,
        "startColumn": 5,
        "endLine": 8,
        "endColumn": 41
      },
      "artifact": {
        "kind": "source",
        "language": "java",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "SHA-256",
        "variant": "SHA-256"
      },
      "api": "java.security.MessageDigest.getInstance",
      "purpose": "hashing",
      "classicalRisk": "no-known-weakness",
      "quantumRisk": "quantum-weakened",
      "migrationUrgency": "monitor",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call java.security.MessageDigest.getInstance"
      },
      "recommendation": "No replacement is recommended from this API evidence alone. Confirm output length and purpose, especially for signatures, password storage, or truncation-sensitive protocols.",
      "references": [
        {
          "title": "NIST FIPS 180-4 — Secure Hash Standard",
          "url": "https://csrc.nist.gov/pubs/fips/180-4/upd1/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "eb0325a4d06f6c024236c3519b27b6bc4526510be61a326367b69ac937016787",
      "rule": {
        "id": "QS1006",
        "title": "Finite-field Diffie-Hellman usage detected"
      },
      "file": "Crypto.java",
      "region": {
        "startLine": 9,
        "startColumn": 5,
        "endLine": 9,
        "endColumn": 46
      },
      "artifact": {
        "kind": "source",
        "language": "java",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "DH",
        "variant": "finite-field"
      },
      "api": "javax.crypto.KeyAgreement.getInstance",
      "purpose": "key-agreement",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-vulnerable",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call javax.crypto.KeyAgreement.getInstance"
      },
      "recommendation": "Treat finite-field Diffie-Hellman as quantum-vulnerable key agreement for migration planning. Assess an ML-KEM-based or standards-supported hybrid path only after confirming protocol and peer interoperability.",
      "references": [
        {
          "title": "NIST FIPS 203 — ML-KEM",
          "url": "https://csrc.nist.gov/pubs/fips/203/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "dddbc040b5504786e5210b3f1a3895eb21a708d4b17b14501aa514f385c03150",
      "rule": {
        "id": "QS7001",
        "title": "Cryptographic dependency declared"
      },
      "file": "Sample.csproj",
      "region": {
        "startLine": 6,
        "startColumn": 32,
        "endLine": 6,
        "endColumn": 49
      },
      "artifact": {
        "kind": "manifest",
        "language": "csharp",
        "ecosystem": "nuget",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "dependency": {
        "ecosystem": "nuget",
        "package": "nsec.cryptography",
        "scope": "package",
        "relationship": "direct",
        "requestedVersion": "24.4.0",
        "manifestType": "csproj"
      },
      "api": "dependency nuget:nsec.cryptography",
      "purpose": "dependency-inventory",
      "classicalRisk": "unknown",
      "quantumRisk": "unknown",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "dependency-declaration",
        "symbol": "declaration nuget:nsec.cryptography"
      },
      "recommendation": "Determine whether this dependency is used or reachable and map its actual algorithms and protocol role. A declaration alone does not establish use, vulnerability, or quantum resistance.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "2fee9f081cf652f488f1bdd5567c43fa7a48ca38538e4faf9c1544f3093a460b",
      "rule": {
        "id": "QS2001",
        "title": "SHA-1 usage detected"
      },
      "file": "crypto.js",
      "region": {
        "startLine": 4,
        "startColumn": 3,
        "endLine": 4,
        "endColumn": 21
      },
      "artifact": {
        "kind": "source",
        "language": "javascript",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "SHA-1",
        "variant": "SHA-1"
      },
      "api": "node:crypto.createHash",
      "purpose": "hashing",
      "classicalRisk": "weak",
      "quantumRisk": "quantum-weakened",
      "migrationUrgency": "review",
      "severity": "medium",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call node:crypto.createHash"
      },
      "recommendation": "Determine whether SHA-1 is used for a security-sensitive purpose. Replace security-sensitive use with a currently approved primitive appropriate to that purpose; do not treat this only as a quantum-migration issue.",
      "references": [
        {
          "title": "NIST FIPS 180-4 — Secure Hash Standard",
          "url": "https://csrc.nist.gov/pubs/fips/180-4/upd1/final",
          "status": "final"
        },
        {
          "title": "NIST SP 800-131A Rev. 2 — Cryptographic Transitions",
          "url": "https://csrc.nist.gov/pubs/sp/800/131/a/r2/final",
          "status": "final"
        }
      ]
    },
    {
      "id": "a977aa9355a9d9f013386f84e7ba905204848579f4d624ff0fa7ead6a66fe6c9",
      "rule": {
        "id": "QS3007",
        "title": "MAC or HMAC usage detected"
      },
      "file": "crypto.js",
      "region": {
        "startLine": 5,
        "startColumn": 3,
        "endLine": 5,
        "endColumn": 38
      },
      "artifact": {
        "kind": "source",
        "language": "javascript",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "MAC",
        "variant": "SHA-256"
      },
      "api": "node:crypto.createHmac",
      "purpose": "message-authentication",
      "classicalRisk": "context-dependent",
      "quantumRisk": "review-required",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call node:crypto.createHmac"
      },
      "recommendation": "Review the message authentication purpose, algorithm, parameters, and surrounding protocol. No weakness or migration requirement is inferred from this API evidence alone.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "a53aff07d3453df5f392f797cbacc19b81ed4355fbf25e526e31380fccfbb027",
      "rule": {
        "id": "QS1001",
        "title": "RSA usage detected"
      },
      "file": "crypto.py",
      "region": {
        "startLine": 8,
        "startColumn": 5,
        "endLine": 8,
        "endColumn": 67
      },
      "artifact": {
        "kind": "source",
        "language": "python",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "RSA",
        "variant": "RSA-2048",
        "keySize": 2048
      },
      "api": "cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key",
      "purpose": "key-generation",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-vulnerable",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key"
      },
      "recommendation": "Determine whether this RSA use provides key establishment, encryption, signatures, or another function. Assess ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures only after confirming protocol and provider support.",
      "references": [
        {
          "title": "NIST FIPS 203 — ML-KEM",
          "url": "https://csrc.nist.gov/pubs/fips/203/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 204 — ML-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/204/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 205 — SLH-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/205/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 186-5 — Digital Signature Standard",
          "url": "https://csrc.nist.gov/pubs/fips/186-5/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "fadbfb6519a4b12958d026b6907e8011b7c1e4e24d3e90d1d191c4aa33dfeda6",
      "rule": {
        "id": "QS3003",
        "title": "SHA-256 usage detected"
      },
      "file": "crypto.py",
      "region": {
        "startLine": 9,
        "startColumn": 5,
        "endLine": 9,
        "endColumn": 33
      },
      "artifact": {
        "kind": "source",
        "language": "python",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "SHA-256",
        "variant": "SHA-256"
      },
      "api": "hashlib.sha256",
      "purpose": "hashing",
      "classicalRisk": "no-known-weakness",
      "quantumRisk": "quantum-weakened",
      "migrationUrgency": "monitor",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call hashlib.sha256"
      },
      "recommendation": "No replacement is recommended from this API evidence alone. Confirm output length and purpose, especially for signatures, password storage, or truncation-sensitive protocols.",
      "references": [
        {
          "title": "NIST FIPS 180-4 — Secure Hash Standard",
          "url": "https://csrc.nist.gov/pubs/fips/180-4/upd1/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "ea2e8fa29622b85debd6829b68546a4fa2ceab280d03dc3a87e12324ec3337dc",
      "rule": {
        "id": "QS1007",
        "title": "EdDSA usage detected"
      },
      "file": "crypto.ts",
      "region": {
        "startLine": 5,
        "startColumn": 3,
        "endLine": 5,
        "endColumn": 33
      },
      "artifact": {
        "kind": "source",
        "language": "typescript",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "EdDSA",
        "variant": "Ed25519",
        "curve": "Ed25519"
      },
      "api": "@noble/curves/ed25519.ed25519.sign",
      "purpose": "digital-signature",
      "classicalRisk": "context-dependent",
      "quantumRisk": "quantum-vulnerable",
      "migrationUrgency": "plan",
      "severity": "high",
      "confidence": 0.99,
      "requiresReview": false,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call @noble/curves/ed25519.ed25519.sign"
      },
      "recommendation": "Treat Ed25519, Ed448, and other EdDSA signature dependencies as quantum-vulnerable for migration planning. Assess ML-DSA or SLH-DSA only after confirming protocol, provider, and interoperability requirements.",
      "references": [
        {
          "title": "NIST FIPS 204 — ML-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/204/final",
          "status": "final"
        },
        {
          "title": "NIST FIPS 205 — SLH-DSA",
          "url": "https://csrc.nist.gov/pubs/fips/205/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "6521a89f42c2725220f45581ba5d6979be08bc47de3b6dc2a99bcb339ea7d8ac",
      "rule": {
        "id": "QS4001",
        "title": "ML-KEM evidence detected"
      },
      "file": "crypto.ts",
      "region": {
        "startLine": 6,
        "startColumn": 10,
        "endLine": 6,
        "endColumn": 28
      },
      "artifact": {
        "kind": "source",
        "language": "typescript",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "ML-KEM",
        "variant": "ML-KEM"
      },
      "api": "@noble/post-quantum/ml-kem.ml_kem768.keygen",
      "purpose": "unknown",
      "classicalRisk": "unknown",
      "quantumRisk": "post-quantum",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call @noble/post-quantum/ml-kem.ml_kem768.keygen"
      },
      "recommendation": "Confirm that the ML-KEM implementation, parameter set, provider, protocol integration, validation status, and interoperability meet deployment requirements. API evidence alone does not prove complete quantum resistance.",
      "references": [
        {
          "title": "NIST FIPS 203 — ML-KEM",
          "url": "https://csrc.nist.gov/pubs/fips/203/final",
          "status": "final"
        },
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "a91a418637e31e2895149ee243e642f41ed33ec765510e705f0f46539a01315a",
      "rule": {
        "id": "QS7001",
        "title": "Cryptographic dependency declared"
      },
      "file": "go.mod",
      "region": {
        "startLine": 5,
        "startColumn": 9,
        "endLine": 5,
        "endColumn": 28
      },
      "artifact": {
        "kind": "manifest",
        "language": "go",
        "ecosystem": "gomod",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "dependency": {
        "ecosystem": "gomod",
        "package": "golang.org/x/crypto",
        "scope": "require",
        "relationship": "direct",
        "requestedVersion": "v0.40.0",
        "manifestType": "go.mod"
      },
      "api": "dependency gomod:golang.org/x/crypto",
      "purpose": "dependency-inventory",
      "classicalRisk": "unknown",
      "quantumRisk": "unknown",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "dependency-declaration",
        "symbol": "declaration gomod:golang.org/x/crypto"
      },
      "recommendation": "Determine whether this dependency is used or reachable and map its actual algorithms and protocol role. A declaration alone does not establish use, vulnerability, or quantum resistance.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "d0277c28b10c436fb9a7bd1745ff73017c77d30331551fd70779a7ef7efbba14",
      "rule": {
        "id": "QS3009",
        "title": "Cryptographic randomness use detected"
      },
      "file": "main.go",
      "region": {
        "startLine": 6,
        "startColumn": 9,
        "endLine": 6,
        "endColumn": 36
      },
      "artifact": {
        "kind": "source",
        "language": "go",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "algorithm": {
        "family": "CSPRNG"
      },
      "api": "crypto/rand.Read",
      "purpose": "random-generation",
      "classicalRisk": "context-dependent",
      "quantumRisk": "review-required",
      "migrationUrgency": "monitor",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "direct-api-usage",
        "symbol": "call crypto/rand.Read"
      },
      "recommendation": "Inventory the randomness source and confirm that its runtime and seeding behavior meet the surrounding protocol requirements. No weakness is inferred from cryptographic RNG API use alone.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "fba4115f3ffad17b6f060f0dca17b4aed2ac7981342bfb3db619005c0c871ea7",
      "rule": {
        "id": "QS7001",
        "title": "Cryptographic dependency declared"
      },
      "file": "package.json",
      "region": {
        "startLine": 4,
        "startColumn": 6,
        "endLine": 4,
        "endColumn": 10
      },
      "artifact": {
        "kind": "manifest",
        "language": "javascript",
        "ecosystem": "npm",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "dependency": {
        "ecosystem": "npm",
        "package": "jose",
        "scope": "dependencies",
        "relationship": "direct",
        "requestedVersion": "^6.0.0",
        "manifestType": "package.json"
      },
      "api": "dependency npm:jose",
      "purpose": "dependency-inventory",
      "classicalRisk": "unknown",
      "quantumRisk": "unknown",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "dependency-declaration",
        "symbol": "declaration npm:jose"
      },
      "recommendation": "Determine whether this dependency is used or reachable and map its actual algorithms and protocol role. A declaration alone does not establish use, vulnerability, or quantum resistance.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "fa9c0ab5ea2b4314fcaa89b8b6c24c454a11e3e4a816f8b1b97238c6e4940cb9",
      "rule": {
        "id": "QS7001",
        "title": "Cryptographic dependency declared"
      },
      "file": "pom.xml",
      "region": {
        "startLine": 1,
        "startColumn": 1,
        "endLine": 1,
        "endColumn": 32
      },
      "artifact": {
        "kind": "manifest",
        "language": "java",
        "ecosystem": "maven",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "dependency": {
        "ecosystem": "maven",
        "package": "org.bouncycastle:bcprov-jdk18on",
        "scope": "compile",
        "relationship": "direct",
        "requestedVersion": "1.80",
        "manifestType": "pom.xml"
      },
      "api": "dependency maven:org.bouncycastle:bcprov-jdk18on",
      "purpose": "dependency-inventory",
      "classicalRisk": "unknown",
      "quantumRisk": "unknown",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "dependency-declaration",
        "symbol": "declaration maven:org.bouncycastle:bcprov-jdk18on"
      },
      "recommendation": "Determine whether this dependency is used or reachable and map its actual algorithms and protocol role. A declaration alone does not establish use, vulnerability, or quantum resistance.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    },
    {
      "id": "29a33d4c3ae003c9fd23d0bd827abcbe657e190be48ed9931b0fdce718474655",
      "rule": {
        "id": "QS7001",
        "title": "Cryptographic dependency declared"
      },
      "file": "requirements.txt",
      "region": {
        "startLine": 1,
        "startColumn": 1,
        "endLine": 1,
        "endColumn": 13
      },
      "artifact": {
        "kind": "manifest",
        "language": "python",
        "ecosystem": "pypi",
        "sourceContext": "application",
        "generated": false
      },
      "buildConstraints": [],
      "dependency": {
        "ecosystem": "pypi",
        "package": "cryptography",
        "scope": "requirements",
        "relationship": "direct",
        "requestedVersion": "==45.0.0",
        "manifestType": "requirements"
      },
      "api": "dependency pypi:cryptography",
      "purpose": "dependency-inventory",
      "classicalRisk": "unknown",
      "quantumRisk": "unknown",
      "migrationUrgency": "review",
      "severity": "informational",
      "confidence": 0.99,
      "requiresReview": true,
      "evidence": {
        "type": "dependency-declaration",
        "symbol": "declaration pypi:cryptography"
      },
      "recommendation": "Determine whether this dependency is used or reachable and map its actual algorithms and protocol role. A declaration alone does not establish use, vulnerability, or quantum resistance.",
      "references": [
        {
          "title": "NIST IR 8547 — Transition to PQC Standards",
          "url": "https://csrc.nist.gov/pubs/ir/8547/ipd",
          "status": "draft"
        }
      ]
    }
  ]
}