Skip to content

Crypto Functions

crypto-functions.json is the primary per-call review report. It contains selected cryptographic API calls after scanner normalization, metadata enrichment, parameter resolution, and deterministic assessment.

Use it to review

  • source file, line, rule, and code evidence;
  • normalized operation and library evidence;
  • detected expressions and resolved/unresolved parameter values;
  • evidence origin, confidence, and OpenGrep flow path;
  • parameter policy findings and remediation;
  • CWE, anti-pattern, quantum-risk, and manual-review facts;
  • algorithm metadata and PQC alternatives when available;
  • FIPS 140-3 evidence and missing runtime/provider context;
  • function lifecycle metadata used by operation grouping.

Parameter summary

The report summary separates detected, resolved, unresolved, and missing evidence and counts functions with unresolved parameters. Rule metadata such as the library name is not counted as a crypto parameter.

For a parameter detail:

  • trust value as concrete only when resolution is RESOLVED;
  • use detectedExpression to see the source form;
  • use origin and flowPath to identify the unresolved owner;
  • review policyFindings only as assessments of resolved values.

Parameter tracing evidence enriches the crypto function and is not counted as a separate function. Anti-pattern helper evidence is also excluded as a separate function row and can be attached as a risk signal to the relevant call.

Typical developer action

Open a row, confirm the source is the intended library/API, inspect security-critical parameters, then evaluate the call in its Operation Group. Rescan after remediation and compare the new report rather than editing generated JSON.