Frequently Asked Questions

What does PostQ discover?

PostQ discovers supported cryptographic use in application source code and generates an inventory of detected calls, operations, algorithms, libraries, and available security settings. Source locations connect the inventory to code that your team can investigate and change.

The inventory is the basis for security assessment and PQC migration review. It is not a live inventory of every deployed key, certificate, service, or hardware device. See Cryptographic Discovery and Inventory.

Which assessment areas does PostQ support?

PostQ presents five dimensions: Quantum exposure, Crypto weaknesses, FIPS source, Crypto agility, and Risk signals. Anti-patterns are part of Risk signals and also inform agility review. Each dimension answers a different question. See Assessment Dimensions for a short scope summary and links to each dimension's result meanings.

Does PostQ make an application quantum-safe?

No. PostQ helps you locate cryptography, identify migration candidates, and investigate available replacement guidance. Your team must implement changes, verify compatibility, and test the application and its deployment. Detection of a PQC algorithm does not establish implementation conformance or end-to-end application security.

Does PostQ score crypto agility?

PostQ provides repository-readiness information and supported source indicators relevant to changing cryptography. It does not provide a per-asset crypto-agility score or estimate migration effort. Use Crypto-agility review to identify the architecture and testing questions your team needs to resolve.

Does PostQ upload source code?

PostQ analyzes source and writes reports on the workstation or runner where you run the scan. Offline license validation does not contact PostQ.

Does no finding mean the repository has no cryptography?

No. It means the scan did not identify supported cryptographic use in the selected source. Check scan completion, scope, language, library coverage, and exclusions.

What is the difference between detected and resolved?

Detected means PostQ found a supported cryptographic call or signal. Resolved means available source evidence establishes a parameter value. A function can be detected while one or more parameters remain unresolved.

Does a resolved parameter mean it is secure?

No. Resolution describes evidence quality. Security policy is a separate assessment, and deployment context can still change the final outcome.

Does the FIPS result certify my application?

No. It reports supported source-level FIPS findings and evidence gaps. Deployment compliance requires additional module and operating-environment evidence. See FIPS Source Assessment.

Can I read reports after the trial expires?

Yes. Existing reports and the standalone Report Viewer remain usable. A valid license is required for new repository and folder scans; limited file scans remain subject to their limits.

Which report should I open first?

For an inventory, start with Crypto Functions and Operation Groups to inspect detected calls and related operations. For review priorities, start with Assessment and follow results to their source evidence. Load the complete scan folder whenever possible, and use its CBOM when exchanging inventory data.

Can I use reports in another security tool?

Use results.sarif with tools that accept SARIF 2.1.0, or cbom.json with tools that accept CycloneDX 1.7 cryptographic inventories. Check which details the receiving tool supports and protect the transferred report data.

Why does a scan with findings exit successfully?

Findings are scan results, not execution failures. A successful report run exits 0. Apply your organization's acceptance policy to report results in a separate CI step.

Can the scanner resolve environment or configuration values?

PostQ can resolve selected values from source and supported Java project .properties files. Runtime environment overrides, secret stores, databases, requests, and unsupported cross-file flows require manual investigation.

Can I scan without internet access?

The scanner and license validation are designed for local/offline operation once the required artifacts and dependencies are installed. Installing third-party prerequisites may require network access unless your organization provides an offline software source.

Why does Windows Defender flag OpenGrep?

An endpoint alert needs review before you run the binary. Confirm the download source, release, and approved file information with your security team. Follow Troubleshooting for the documented download and review steps.

Is the Report Viewer a scanner?

No. It reads completed report files. It does not run OpenGrep, create findings, or require a scanner license.

How do I report an apparent false positive or missing API?

Retain the product version, ruleId, redacted source evidence, language/library identity, expected behavior, and manifest.json. Use the approved PostQ support channel associated with your entitlement. Do not send unrelated source or the license file.