Risk Signals

Risk signals are observations that help explain cryptographic use and direct further review. They include context, coding anti-patterns, and supported parameter concerns. A signal alone is not a vulnerability verdict; read it alongside the relevant assessment and source evidence.

Result meanings

Result	Meaning
SIGNALS_REPORTED	One or more observations are available. Review the named signals and their explanations.
NONE_REPORTED	No signals were reported for the item. This is not a complete security assessment.

The compact Risk signals-N label counts observations for that row. The same issue can also appear under Crypto weaknesses or another dimension, so signal totals are not additional unique vulnerabilities.

Context observations

Signal code	What it means
ALGORITHM_EXPOSURE	Displayed as Algorithm reference detected (Context). An algorithm reference is present; the value can still be unresolved. It does not itself mean quantum exposure or a weakness.
PROTOCOL_EXPOSURE	Protocol information is present for review. It does not establish insecure negotiation.
KEY_MATERIAL_EXPOSURE	Key-related information is present, such as a key or key-size reference. The name does not mean a key has leaked.

Anti-patterns

Anti-patterns identify supported source choices that can deserve maintainability or security review. They are a subset of Risk signals, not a sixth assessment dimension.

Signal code	What it means
HARDCODED_ALGORITHM	A fixed algorithm choice is reported. Review how the choice could be changed.
HARDCODED_KEY_SIZE	A fixed key size is reported. Fixed does not itself mean too small.
HARDCODED_PROVIDER	A fixed provider choice can create a dependency on a particular implementation.
HARDCODED_MODE	A fixed cipher mode is reported. Read separate weakness findings to assess its security.
HARDCODED_PADDING	A fixed padding choice is reported. Its suitability depends on the operation.
MISSING_ALGORITHM_CONFIGURATION	A supported pattern indicates that an algorithm choice lacks a configuration option.
TIGHT_COUPLING	A supported pattern indicates dependencies that may complicate replacing cryptography.
NO_ABSTRACTION_LAYER	A supported pattern indicates direct dependencies on cryptographic choices. This is not a review of the entire application's architecture.

Older results may report an unnamed anti-pattern when a specific pattern code is unavailable. Use the supplied evidence rather than guessing which pattern applies. For how these observations inform replacement planning, see Crypto Agility.

Other security observations

Signal code	What it means
IMPLEMENTATION_WEAKNESS	A supported implementation concern is reported. Its explanation establishes the specific concern.
WEAK_KEY_SIZE	A supported check identifies an insufficient key size.
WEAK_RANDOMNESS	A supported check identifies a randomness concern.
LOW_ITERATION_COUNT	A supported password or derivation check identifies too few iterations.
SHORT_AUTHENTICATION_TAG	A supported check identifies an insufficient authentication-tag length.

Availability depends on the library, source pattern, and evidence. A list of signal names does not mean every signal is checked for every operation.

What signals do not establish

PostQ does not infer your data-retention requirements or confidentiality lifetime from a cryptographic call. Signals also do not establish exploitability, business impact, or complete application security. Use Crypto Weaknesses for supported CWE conclusions and Assessment Dimensions for the distinction between observations, assessments, and follow-up work.