Administration and Support

Use these capabilities to prepare scanning environments, maintain access to results, and support repeatable reviews. Product setup and local operating procedures work together to protect scan evidence.

Language and library coverage

Before adopting PostQ for an application, check whether its languages and cryptographic libraries are covered. Support for a language does not imply coverage of every API or coding pattern.

Use Languages and Libraries Supported for the covered library families and their review limitations.

Release scope

Use the assessment capability pages to understand which security conclusions the installed product can support.

Consult Assessment Dimensions for the five dimensions and their limits. Use Versions to confirm that the manual matches your installed product.

Offline license activation

Activate licensed scans with an issued postq.lic file. License validation runs locally without an online activation service.

Pass --license-file <path> in the CLI, or select the license file in the IDE configuration. For container scans, mount the license and pass its container path. See Activate a License.

License status

Check license readiness before a scheduled scan or when activation fails. Run the CLI with --license-status --license-file <path>, or refresh the IDE configuration.

The status identifies whether activation permits the requested scan. About output can be used to inspect product and license information without starting a scan. See Command Line.

License removal

IDE configuration controls let you remove an installed or configured license. In VS Code, use Remove Installed License; in Eclipse, use Remove License.

VS Code removes its managed license copy after confirmation. Eclipse clears its configured path and preserves the original file. Removal preserves trial history and does not restart an evaluation. See Activate a License.

Product and build information

Use About when recording your environment for support or checking an installation. Run postq-code-scanner-cli --about, or select About PostQ Code Scanner in the IDE Configuration view.

The output identifies the product build and applicable license information. Application version labels in scan reports are configured separately.

Configuration readiness

The IDE Configuration view checks the required tools and license before applicable scans. This helps you resolve setup problems before scanning a workspace or project.

Use Refresh Configuration after changing Java, OpenGrep, or license settings. Follow Prerequisites for requirements and Troubleshooting for failed checks.

Local source processing

PostQ scans source on the workstation or runner where you execute it and writes reports locally. The current beta performs local analysis without an external analysis integration.

Choose an approved machine and output directory. Configure filesystem permissions and report access using your organization's existing controls. See Security and Privacy.

Access to completed reports

Completed reports remain readable in the standalone viewer after an evaluation period ends. This allows reviewers to retain access to the evidence already collected.

Keep the report folder and compatible viewer together. Starting new licensed scans still requires valid entitlement. See Report Viewer.

Report retention

Use IDE history settings to manage local snapshots and archive complete scan folders for longer-term review. Keep the manifest and the source revision reference with retained evidence.

Apply your organization's retention policy to both reports and supporting logs. Reports can contain source paths, excerpts, and sensitive settings. See Report history.

Container operating controls

The container deployment supports separating read-only source and license mounts from writable report storage. Deployment examples also show runtime restrictions suitable for managed runners.

Use the instructions in Container Runner and CI/CD. Preserve required licensing state between scans as described in the licensing guide.

Troubleshooting information

CLI and IDE scan output provide progress, diagnostic messages, and execution status. In VS Code, check the PostQ Scanner terminal and PostQ Crypto Readiness Output channel. In Eclipse, check the PostQ console and Error Log.

For a support request, record the product and tool versions, operating system, exit code, redacted command, and manifest. Check the evidence for sensitive data before sharing it. See Troubleshooting.