Supported Languages¶
PostQ support is rule-backed and qualified. A language directory or file extension does not mean that every crypto API, library, framework, or parameter flow is recognized.
Support levels¶
| Level | Meaning |
|---|---|
| Broad rule inventory | Multiple crypto-operation families plus targeted parameter flow are represented. |
| API detection with gaps | Crypto APIs are detected, but some library/operation metadata is incomplete. |
| Flow helper only | Targeted parameter sinks exist, but the language does not independently produce a complete crypto-function inventory. |
Current matrix¶
| Language | Level | Representative coverage | Targeted intrafile resolution |
|---|---|---|---|
| Java | Broad rule inventory | JCA/JCE, Bouncy Castle, Commons Codec, JJWT, Nimbus, Vault | Algorithm, provider, key size, mode, curve, KDF, tag length, hash, protocol |
| C | Broad rule inventory | OpenSSL, GSKit, liboqs/OQS and imported native APIs | Key size, PBKDF2, derived-key length, GCM tag length |
| C++ | Flow helper only | OpenSSL and Crypto++ parameter sinks | Key size, KDF iterations, authentication-tag length |
| C# | Broad rule inventory | System.Security.Cryptography |
Key size, PBKDF2, AesGcm tag length |
| Go | Broad rule inventory | Standard crypto/*, hash/*, golang.org/x/crypto/* |
RSA size, PBKDF2, derived-key length, scrypt cost |
| Python | Broad rule inventory | cryptography, PyCryptodome, hashlib, hmac |
Key size, KDF iterations, derived-key length, scrypt cost |
| JavaScript | API detection with gaps | Node.js crypto, Web Crypto, CryptoJS, crypto-browserify, TLS/HTTPS | RSA modulus, PBKDF2, derived-key length, AEAD tag length |
| TypeScript | Flow helper only | Node.js crypto parameter sinks | RSA modulus, PBKDF2, derived-key length, AEAD tag length |
Common detection families¶
Where maintained rules exist, PostQ can detect symmetric/asymmetric crypto, key generation and exchange, signatures, hashing, MAC, password/key derivation, random generation, certificates/PKI, protocols, JWT operations, and crypto-agility anti-patterns.
Resolution boundary¶
Direct literals, local constants, and targeted same-file return flows can be resolved when OpenGrep provides deterministic evidence. The scanner does not invent values for:
- environment or deployment configuration;
- requests, databases, secret stores, or network input;
- cross-file or cross-module calculations;
- reflection, dynamic dispatch, callbacks, or runtime mutation;
- generated source or build-time substitution not present in scanned evidence.
An absent finding means no configured rule matched. An unresolved parameter means the function can still be detected, but the value needs manual/runtime investigation.
Language hint values¶
Use these CLI values: java, c, cpp, csharp, go, python, javascript, typescript.
Choose a hint only when the selected path represents that source tree.