QuantumSafe Scanner

The problem

Cryptographic dependencies can be difficult to locate in source repositories before a bounded quantum-readiness review.

What Evolext built

• Offline source and local dependency discovery
• Deterministic console and JSON report output
• A published synthetic sample report

Engineering approach

The scanner uses language-aware analysis and reviewed detection rules. Findings are candidates for contextual human review, not conclusions about a deployed system.

A real engineering decision: keep discovery offline

QuantumSafe Scanner is an independent research prototype. Its repository documents the following implementation choice; it is not evidence of a client delivery process.

Decision

Inspect authorized source and recognized local dependency declarations without uploading a repository or running its code.

Reason

Local, read-only discovery limits unnecessary exposure of repository content and avoids executing untrusted project code during a scan.

Tradeoff

Static findings are candidates for human review. They do not establish runtime use, complete coverage, deployment status, or successful post-quantum negotiation.

Observable output

A synthetic v0.2.0 report can be inspected without sharing a customer repository. It demonstrates the report format and example findings, not measured coverage in a real deployment.

Evidence and limitations

Supported sources and local declarations only. It does not establish runtime use, full inventory coverage, security, certification, or successful post-quantum negotiation. NIST FIPS 203, 204, and 205 are algorithm references, not certification of this tool.

Inspect the evidence

• Inspect synthetic sample report ↗
• Explore the scanner ↗