Product Overview¶
PostQ Code Scanner helps application-security, cryptography, and engineering teams build an evidence-based inventory of cryptographic use in source code. It connects each matched crypto API to its source location, available parameter evidence, scanner assessment, and logical operation.
What the product does¶
The scanner can:
- detect configured cryptographic APIs and crypto-agility anti-patterns;
- preserve source location, code evidence, rule identity, library evidence, and normalized operation metadata;
- resolve supported literals, constants, and targeted same-file data flows without guessing;
- assess available algorithm, quantum-risk, CWE, FIPS, and numeric policy facts;
- group related calls into crypto-operation lifecycles;
- produce deterministic reports for developers, reviewers, inventory systems, and security tools;
- keep completed reports readable after a trial expires.
What the product does not claim¶
The scanner does not:
- prove that unmatched code contains no cryptography;
- resolve arbitrary runtime values, reflection, dynamic dispatch, external configuration, or every cross-file flow;
- certify FIPS compliance or validate a production module's certification state;
- replace an organization's cryptographic standard, threat model, or migration program;
- modify source code automatically;
- require a cloud service for license validation or deterministic report generation.
Processing model¶
- Prepare: validate configuration and license state, select the source, and prepare packaged language rules.
- Detect: run OpenGrep and retain its raw result as evidence.
- Normalize: create canonical findings and validate captured metadata.
- Enrich: attach function, algorithm, parameter, policy, quantum, CWE, and FIPS facts.
- Group: connect related calls into operation lifecycles.
- Report: write deterministic JSON, CBOM, SARIF, and a manifest.
- Review: load those reports in the CLI, an IDE host, or the standalone viewer.
Evidence states¶
| State | Meaning |
|---|---|
| Detected | A maintained scanner rule matched source evidence. |
| Resolved | The scanner has deterministic evidence for a reported parameter value. |
| Assessed | Scanner metadata or policy evaluated the facts that were available. |
| Unknown or unresolved | Static evidence was insufficient; a reviewer must inspect runtime or external context. |
These states are separate. A resolved parameter can still be insecure, and a detected function can still contain unresolved parameters.
Interfaces and roles¶
| Interface | Primary role | Typical use |
|---|---|---|
| CLI | Build engineer, security engineer | Repeatable local and CI scans |
| VS Code | Application developer | Scan, investigate, compare, and navigate to source |
| Eclipse | Java developer | Project scans, findings, markers, history, and source navigation |
| Container | Platform engineer | Controlled, reproducible, non-interactive execution |
| Report Viewer | Reviewer, auditor, architect | Read and share completed report folders without running scans |
Continue with Quick Start or review the Supported Languages.