Run Your First Scan

Generate a cryptographic inventory and assessments from a representative repository with a known owner and a manageable review scope. Keep source and reports in separate directories.

Native CLI

WindowsLinux or macOS

.\bin\postq-code-scanner-cli.bat `
  --project C:\path\to\repository `
  --output C:\path\to\postq-reports `
  --name customer-api `
  --version 1.0.0 `
  --license-file C:\secure\postq.lic

./bin/postq-code-scanner-cli \
  --project /path/to/repository \
  --output /path/to/postq-reports \
  --name customer-api \
  --version 1.0.0 \
  --license-file /secure/postq.lic

Use --language when the selected path is a specific language tree:

./bin/postq-code-scanner-cli --project /path/to/repository --language java

Use --skip-folder when generated report, dependency, or build folders live under the selected source tree:

./bin/postq-code-scanner-cli \
  --project /path/to/repository \
  --output /path/to/repository/reports/postq/scans/latest \
  --skip-folder reports \
  --skip-folder build

If OpenGrep is installed outside PATH:

./bin/postq-code-scanner-cli \
  --opengrep-path /opt/opengrep/bin/opengrep \
  --project /path/to/repository

What happens during the scan

The CLI checks the configuration and license, scans the selected source, and writes reports to your output directory. Progress and diagnostic messages appear in the terminal.

Wait for completion before opening the results. A successful scan returns exit code 0 even when it finds security issues; review the reports to decide what action is needed.

Generated output

The report set includes the detected inventory, its assessment, and evidence for investigation. Use Crypto Functions and Operation Groups to inspect cryptographic use, Assessment to prioritize review, and the CBOM to exchange detected asset information.

File	Start here when...
manifest.json	You need scan identity, artifact inventory, or warnings.
opengrep-results/opengrep-results.json	You are troubleshooting engine evidence.
findings.json	You need supporting findings and parameter evidence.
crypto-functions.json	You are reviewing individual crypto calls.
operation-groups.json	You are reviewing complete crypto-operation lifecycles.
crypto-finding-assessment.json	You need repository posture and prioritized review work.
cbom.json	You are integrating a CycloneDX 1.7 cryptography bill of materials.
results.sarif	You are integrating with SARIF-compatible security tooling.
index.html	You copied the packaged standalone viewer into the report folder after the scan.

Confirm success

1. Check that the CLI returned exit code 0.
2. Open manifest.json and confirm the project name, version, and artifact list.
3. Confirm inputs.skipFolders contains any folders intentionally excluded from the scan.
4. Review unresolved parameter counts before interpreting policy or compliance results.
5. Copy report-viewer/index.html from the CLI or container artifact into the output folder when reviewers need a directly openable report.
6. Retain the whole output folder, not only one JSON file.

Continue with Establish an application baseline to review inventory coverage, retain the CBOM, and identify follow-up work.

No findings does not prove that the source contains no cryptography. Review the Languages and Libraries Supported and scan scope before closing the result.