Find every RSA key
before your 2028 deadline does.
QuantumSafeVault parses your source via native AST, probes what's actually live on the wire, and scores the result — no dashboard to configure, no agent to install.
Exposure score
73/100
847 crypto assets scanned · 3 languages
RSA-2048auth/jwt_handler.py :42
SHA-1utils/hash.py :9
TLS 1.1api.yourcompany.com :443
ML-KEM-768crypto/pqc.py :7
Scoped toFIPS 203 · FIPS 204/
NCSC PQC Roadmap/CycloneDX CBOM/EU NIS2
Product
One command, three outputs.
No config file to write first. Point it at a repo and a domain, get back the CBOM, the exposure map, and the report.
Static analysis, real output
AST parsing across Python, Java, and Go — alias resolution included, so import hashlib as h doesn't hide anything.
$ qscan ./repo --cbom-export --probe api.co
Parsing 1,247 files…
⚠ RSA-2048 — auth/jwt_handler.py:42
⚠ TLS 1.1 — api.co:443
cbom.json · report.html written
Parsing 1,247 files…
⚠ RSA-2048 — auth/jwt_handler.py:42
⚠ TLS 1.1 — api.co:443
cbom.json · report.html written
Standards-compliant CBOM
Exports a valid CycloneDX cryptographic bill of materials — plugs into whatever compliance workflow you already run.
{
"bomFormat": "CycloneDX",
"component": {
"cryptoProperties": {
"algorithm": "RSA-2048",
"quantumSafe": false
}
}
}
"bomFormat": "CycloneDX",
"component": {
"cryptoProperties": {
"algorithm": "RSA-2048",
"quantumSafe": false
}
}
}
Language coverage
Fintech backends aren't all Python.
Python
Java
Go
Migration timeline
Every finding is mapped to where it sits on the clock.
2026Exposure starts now
2028NCSC: plans expected
2035Migration complete
CI/CD native
Structured exit codes mean a vulnerable primitive can fail a build, not just a report nobody reads.
exit 1
Ciphertext captured today can be broken later.
FIRST SCAN — NO COST, NO OBLIGATION