Run Your First Scan¶

Scan a representative repository with a known owner and a manageable review scope. Keep source and reports in separate directories.

Native CLI¶

WindowsLinux or macOS

.\bin\postq-code-scanner-cli.bat `
  --project C:\path\to\repository `
  --output C:\path\to\postq-reports `
  --name customer-api `
  --version 1.0.0 `
  --license-file C:\secure\postq.lic

./bin/postq-code-scanner-cli \
  --project /path/to/repository \
  --output /path/to/postq-reports \
  --name customer-api \
  --version 1.0.0 \
  --license-file /secure/postq.lic

Use --language when the selected path is a specific language tree:

./bin/postq-code-scanner-cli --project /path/to/repository --language java

If OpenGrep is installed outside PATH:

./bin/postq-code-scanner-cli \
  --opengrep-path /opt/opengrep/bin/opengrep \
  --project /path/to/repository

What happens during the scan¶

The CLI validates configuration and license state, starts OpenGrep with packaged rules, normalizes the raw evidence, resolves supported parameter facts, performs deterministic assessments, groups related crypto calls, and writes the report set. OpenGrep exit code 1 means it found matches and is treated as a successful engine result.

Generated output¶

File	Start here when...
`manifest.json`	You need scan identity, artifact inventory, or warnings.
`opengrep-results/opengrep-results.json`	You are troubleshooting engine evidence.
`findings.json`	You need canonical normalized evidence.
`crypto-functions.json`	You are reviewing individual crypto calls.
`operation-groups.json`	You are reviewing complete crypto-operation lifecycles.
`crypto-finding-assessment.json`	You need repository posture and prioritized review work.
`cbom.json`	You are integrating a cryptography bill of materials.
`results.sarif`	You are integrating with SARIF-compatible security tooling.

Confirm success¶

Check that the CLI returned exit code 0.
Open manifest.json and confirm the project name, version, and artifact list.
Review unresolved parameter counts before interpreting policy or compliance results.
Retain the whole output folder, not only one JSON file.

No findings does not prove that the source contains no cryptography. Review the Supported Languages and scan scope before closing the result.