PostQ product documentation
Welcome to PostQ Code Scanner
Discover cryptographic use in source code, review quantum and FIPS evidence, and create portable reports for engineering and security teams.
PostQ Code Scanner is a local-first source analysis product for cryptographic discovery and review. It runs deterministic scanner stages, preserves the evidence behind each result, and creates files that can be reviewed in an IDE, in the standalone viewer, or by downstream security tools.
Evaluate the product
Check prerequisites, activate the offline trial, and complete a first scan.
Open Quick StartScan in daily work
Use the CLI, VS Code, Eclipse, a container, or your CI runner.
Choose an interfaceReview evidence
Understand crypto calls, grouped operations, repository posture, CBOM, and SARIF.
Review reportsOperate securely
Plan deployment, protect report data, and troubleshoot repeatably.
Read operational guidanceThe shortest path to a useful result¶
- Run the distributed prerequisite checker.
- Install either the native CLI or the container image.
- Place the PostQ-issued
postq.licfile in an approved secure location. - Scan one representative repository.
- Open
crypto-functions.json,operation-groups.json, andcrypto-finding-assessment.jsonin the Report Viewer or an IDE integration.
Product trust boundary¶
The scanner owns detection, parameter evidence, assessment, grouping, and report generation. IDE extensions and the Report Viewer display scanner-generated facts; they do not calculate new risk, confidence, quantum, CWE, FIPS, policy, or remediation decisions.
Understanding coverage
PostQ Code Scanner reports cryptographic evidence identified within the supported languages, libraries, APIs, and rule coverage for the installed version. If your application uses custom cryptographic wrappers, proprietary frameworks, or technologies not listed in the support matrix, contact your PostQ representative to confirm coverage and discuss your requirements.
Documentation scope¶
This manual applies to PostQ Code Scanner 0.1.0-Beta. Commands use <version> where artifact
names vary by build. Contractual rights and obligations are defined only by the approved license
and product terms supplied with the applicable artifact, not by this website.