Skip to content

Interpret Results

PostQ separates detection, resolution, and assessment so reviewers can see what is known and what still requires runtime or application context.

Use the evidence states correctly

State Reviewer interpretation
DETECTED A configured rule matched a crypto API, operation, or anti-pattern.
RESOLVED Deterministic static evidence supports the reported parameter value.
DYNAMIC_OR_UNRESOLVED The expression was seen, but the final value cannot be proven statically.
MISSING A required parameter is not represented by the available rule evidence.
Assessed Scanner policy or metadata evaluated the facts that were available.

RESOLVED does not mean secure. UNRESOLVED does not mean undetected. An unknown result should create review work instead of being converted to a safe or unsafe assumption.

  1. Open the repository assessment to understand scale, high-risk counts, and manual-review demand.
  2. Prioritize operation groups with high quantum impact, failed FIPS evidence, anti-patterns, or unresolved security-critical parameters.
  3. Open the group steps and inspect each function's source location and parameters.
  4. Check resolution, origin, evidenceSource, and flowPath before trusting a displayed value.
  5. Apply scanner remediation direction together with the application's threat model, deployment configuration, and approved cryptographic standard.
  6. Record the decision outside the immutable generated report, then rescan changed source.

Parameter evidence

Common resolvable cases include direct literals, local constants, and targeted same-file values reported by OpenGrep. Environment variables, configuration providers, requests, databases, secret stores, reflection, cross-module calls, mutable state, and generated values commonly remain unresolved.

Use origin to locate the responsible runtime owner. A CONFIGURATION origin is useful evidence, but it does not prove the production setting.

FIPS evidence

PostQ evaluates algorithm properties and available provider/runtime facts against maintained metadata. A compliant-looking result does not certify the application, cryptographic module, deployment, key management, or operational mode. Review the referenced provider, runtime, module certificate, and deployment configuration independently.

Official background: NIST FIPS 140-3.

Quantum classification

Quantum classification is one input to migration planning. Review data lifetime, protocol interoperability, key management, dependency readiness, and deployment constraints before choosing a post-quantum replacement.

Official background: NIST Post-Quantum Cryptography.

Absence of evidence

An empty report can result from genuinely absent matched usage, unsupported APIs, an incorrect language hint, excluded source, incomplete rule coverage, or old/reused raw results. Check the scan scope and raw evidence before concluding that the repository has no cryptography.