PostQ Code Scanner¶
PostQ Code Scanner discovers cryptographic assets in application source code and generates an inventory linked to the code that uses them. It identifies supported algorithms, libraries, operations, and security settings so your team can understand its cryptographic dependencies.
Use this inventory and its assessments to investigate cryptographic weaknesses, improve security posture, and plan migration to post-quantum cryptography (PQC). This manual explains how to install PostQ, generate and review an inventory, prioritize changes, and retain evidence for ongoing review.
From discovery to action¶
| Your objective | How PostQ supports your work |
|---|---|
| Establish a cryptographic inventory | Locate supported cryptographic use, inspect source and configuration, and generate a cryptography bill of materials (CBOM). |
| Assess security and migration needs | Review Quantum exposure, Crypto weaknesses, FIPS source, Crypto agility, and Risk signals, including anti-patterns. |
| Plan and verify changes | Investigate affected operations, use available remediation guidance, and rescan changed source to review the results. |
| Maintain review evidence | Retain scan baselines, compare completed scans in an IDE, and share inventory and findings with compatible tools. |
The Product Overview explains these capabilities and their scope. PostQ analyzes source locally; its results support security and compliance reviews but do not certify a deployment or guarantee that an application is quantum-safe.
Start here¶
| Your task | Guide |
|---|---|
| Evaluate discovery, inventory, and assessment capabilities | Product Overview |
| Find a capability or review workflow | Product Features |
| Install PostQ and run a first scan | Getting Started |
| Scan from your workstation, IDE, or pipeline | Choose an Interface |
| Open and interpret completed results | Reports and Data |
| Confirm language and library coverage | Languages and Libraries Supported |
| Configure a deployment or plan an upgrade | Administration |
| Resolve an installation, scan, or report problem | Troubleshooting |
Build your first inventory¶
- Choose an interface and complete its quick start.
- Scan a representative application or the supplied sample project.
- Open the complete report folder in the Report Viewer or an IDE integration.
- Inspect Crypto Functions for detected calls and Operation Groups for related operations.
- Open Assessment to review security findings, quantum exposure, and missing evidence.
- Retain the complete report folder and its CBOM as a baseline. Record follow-up work in your team's tracking system.
For repeatable daily use, follow Everyday Security Workflows.
About this manual¶
This manual applies to PostQ Code Scanner 0.1.0-beta. Use the version information to check that these instructions match your installation.
Coverage depends on the language, library, API use, and source included in the scan. Consult Assessment Dimensions before using results for security or compliance decisions. For custom libraries or source patterns, contact your PostQ representative to discuss coverage.
Product use is governed by the terms supplied with your release. See Legal and Licensing.