Skip to content

PostQ product documentation

Welcome to PostQ Code Scanner

Discover cryptographic use in source code, review quantum and FIPS evidence, and create portable reports for engineering and security teams.

PostQ Code Scanner is a local-first source analysis product for cryptographic discovery and review. It runs deterministic scanner stages, preserves the evidence behind each result, and creates files that can be reviewed in an IDE, in the standalone viewer, or by downstream security tools.

Evaluate the product

Check prerequisites, activate the offline trial, and complete a first scan.

Open Quick Start

Scan in daily work

Use the CLI, VS Code, Eclipse, a container, or your CI runner.

Choose an interface

Review evidence

Understand crypto calls, grouped operations, repository posture, CBOM, and SARIF.

Review reports

Operate securely

Plan deployment, protect report data, and troubleshoot repeatably.

Read operational guidance

The shortest path to a useful result

  1. Run the distributed prerequisite checker.
  2. Install either the native CLI or the container image.
  3. Place the PostQ-issued postq.lic file in an approved secure location.
  4. Scan one representative repository.
  5. Open crypto-functions.json, operation-groups.json, and crypto-finding-assessment.json in the Report Viewer or an IDE integration.

PostQ scan and review workflow

Product trust boundary

The scanner owns detection, parameter evidence, assessment, grouping, and report generation. IDE extensions and the Report Viewer display scanner-generated facts; they do not calculate new risk, confidence, quantum, CWE, FIPS, policy, or remediation decisions.

Understanding coverage

PostQ Code Scanner reports cryptographic evidence identified within the supported languages, libraries, APIs, and rule coverage for the installed version. If your application uses custom cryptographic wrappers, proprietary frameworks, or technologies not listed in the support matrix, contact your PostQ representative to confirm coverage and discuss your requirements.

Documentation scope

This manual applies to PostQ Code Scanner 0.1.0-Beta. Commands use <version> where artifact names vary by build. Contractual rights and obligations are defined only by the approved license and product terms supplied with the applicable artifact, not by this website.