pqc-check

Scan your codebase for quantum-vulnerable cryptography

Quick Start

npx pqc-check ./my-project

That's it. One command, instant results.

Why?

Quantum computers running Shor's algorithm will break RSA, ECDSA, and Diffie-Hellman. The threat isn't theoretical — nation-state actors are already harvesting encrypted traffic today to decrypt later ("harvest now, decrypt later"). pqc-check scans your codebase and tells you exactly what needs to change.

Installation

# Run directly (no install)
npx pqc-check ./my-project

# Install globally
npm install -g pqc-check

# Then run
pqc-check ./my-project

Usage

# Basic scan (console output)
pqc-check ./my-project

# JSON output
pqc-check ./my-project --format json

# SARIF output (for GitHub Code Scanning)
pqc-check ./my-project --format sarif

# Scan only specific languages
pqc-check ./my-project --lang python,go

# Include LOW risk findings (hidden by default)
pqc-check ./my-project --show-low

# Ignore specific paths
pqc-check ./my-project --ignore "tests/**,vendor/**"

# Minimal output (no banner)
pqc-check ./my-project --quiet

# Hide migration suggestions
pqc-check ./my-project --no-suggestions

Supported Languages

| Language | Extensions | Patterns | |----------|-----------|----------| | Python | .py | RSA, ECDSA, Ed25519, X25519, DH, JWT, SHA | | JavaScript/TypeScript | .js, .ts, .mjs, .cjs, .jsx, .tsx | RSA, ECDSA, ECDH, DH, JWT, Web Crypto | | Go | .go | RSA, ECDSA, Ed25519, X25519/ECDH | | Java/Kotlin | .java, .kt | RSA, ECDSA, DH, Bouncy Castle | | Rust | .rs | RSA (rsa/ring), ECDSA, Ed25519, X25519 | | C/C++ | .c, .cpp, .h, .hpp | OpenSSL RSA, ECDSA, DH, Ed25519 | | Ruby | .rb | OpenSSL RSA, ECDSA, DH | | PHP | .php | openssl RSA, ECDSA, DH | | Config files | .conf, .yaml, .yml, .toml, .ini | SSL certs, PEM keys, cipher suites |

Risk Levels

| Level | Meaning | Action | |-------|---------|--------| | HIGH | Harvest Now, Decrypt Later — data confidentiality at risk | Migrate immediately to PQC | | MEDIUM | Signature forgery — authentication at risk | Plan migration to PQC | | LOW | Informational — quantum-resistant, no action needed | No action |

Output Formats

Console (default)

  pqc-check v1.0.0 — Quantum Vulnerability Scanner

  Scanning 142 files in ./my-project ...

  HIGH RISK — Harvest Now, Decrypt Later
  ──────────────────────────────────────
    src/auth.py:23         RSA Key Generation
    src/encryption.py:45   RSA Encryption (PKCS1)

  MEDIUM RISK — Signature Forgery
  ────────────────────────────────
    src/signing.py:45      ECDSA Signing
    src/jwt.py:67          JWT RS256 Signing

  SUMMARY
  ├── 2 HIGH    → Migrate to ML-KEM-768 (Kyber768)
  └── 2 MEDIUM  → Migrate to ML-DSA-65 (Dilithium3)

JSON

pqc-check ./my-project --format json

SARIF (GitHub Code Scanning)

pqc-check ./my-project --format sarif > results.sarif

CI/CD Integration

GitHub Actions

- name: PQC vulnerability scan
  run: npx pqc-check . --format sarif > results.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Exit Codes

| Code | Meaning | |------|---------| | 0 | No HIGH or MEDIUM findings | | 1 | HIGH or MEDIUM findings found | | 2 | Error (invalid path, etc.) |

Configuration

.pqcignore

Create a .pqcignore file in your project root (same format as .gitignore):

# Ignore test files
tests/
test/

# Ignore vendor code
vendor/
third_party/

Ready to Migrate?

Found quantum-vulnerable code? Qpher provides drop-in PQC APIs for encryption (Kyber768 / ML-KEM-768) and digital signatures (Dilithium3 / ML-DSA-65). All cryptographic operations are powered by liboqs (Open Quantum Safe) — the industry-standard open-source PQC library implementing NIST FIPS 203/204.

v1.1 coming soon: Hybrid PQC + classical algorithms (X-Wing KEM, Composite ML-DSA) for defense-in-depth during the transition — following the approach used by AWS, Google Cloud, and Cloudflare.

pip install qpher          # Python SDK
npm install @qpher/sdk     # Node.js SDK
go get github.com/qpher/qpher-go  # Go SDK

Contributing

PRs welcome! See CONTRIBUTING.md for guidelines.

License

MIT

Powered by Qpher — Post-Quantum Cryptography APIs | Built on Open Quantum Safe