Frequently Asked Questions

Does PostQ upload source code?

The scanner runs locally, invokes local OpenGrep, and writes reports locally. Offline license validation does not contact PostQ.

Does no finding mean the repository has no cryptography?

No. It means no configured rule matched the scanned evidence. Check scan scope, selected language, supported APIs, exclusions, raw OpenGrep results, and known coverage limitations.

What is the difference between detected and resolved?

Detected means a rule matched a crypto API or signal. Resolved means deterministic static evidence supports a reported parameter value. A function can be detected while one or more parameters remain unresolved.

Does a resolved parameter mean it is secure?

No. Resolution describes evidence quality. Security policy is a separate assessment, and deployment context can still change the final outcome.

Does the FIPS result certify my application?

No. It summarizes scanner evidence about algorithm properties and available provider/runtime context. Certification requires independent validation of the module, certificate, approved mode, configuration, key management, and deployment.

Can I read reports after the trial expires?

Yes. Existing reports and the standalone Report Viewer remain usable. A valid entitlement is required to run new scans in an enforced distribution.

Which report should I open first?

Security leads usually start with crypto-finding-assessment.json; developers start with operation-groups.json; detailed reviewers use crypto-functions.json. Keep manifest.json with the complete report set.

Can I use reports in another security tool?

Use results.sarif for SARIF-compatible code scanning and cbom.json for CBOM consumers. Confirm the receiving system's accepted schema and protect the transferred data.

Why does a scan with findings exit successfully?

Findings are scan results, not execution failures. A successful report run exits 0. Apply your organization's acceptance policy to deterministic report fields in a separate CI step.

Can the scanner resolve environment or configuration values?

Only when deterministic evidence is available to the supported OpenGrep flow. Runtime environment, secret-store, database, request, and cross-module values commonly remain unresolved and require manual investigation.

Can I scan without internet access?

The scanner and license validation are designed for local/offline operation once the required artifacts and dependencies are installed. Installing third-party prerequisites may require network access unless your organization provides an offline software source.

Is the Report Viewer a scanner?

No. It reads completed report files. It does not run OpenGrep, create findings, or require a scanner license.

How do I report an apparent false positive or missing API?

Retain the product version, ruleId, redacted source evidence, language/library identity, expected behavior, and manifest.json. Use the approved PostQ support channel associated with your entitlement. Do not send unrelated source or the license file.