pqc-scan · Sachit Madaan

pqc-scan finds quantum-vulnerable cryptography in a codebase. It runs as a CLI tool or a GitHub Action, looks for RSA, ECDSA, and Diffie-Hellman usage, and reports the call sites along with the dependencies that pull them in. Point it at CI and it fails the build when someone introduces a new one.

It parses instead of grepping. Tree-sitter grammars cover Python, JavaScript, Java, and Go, and the scanner tracks where an import actually came from and how the function was called. That distinction is most of the work: a bare generate_private_key only counts if it resolves to cryptography.hazmat and was called with an RSA backend. Matching on the string alone gives you noise.

Output is SARIF 2.1.0, so findings show up in GitHub code scanning rather than in build logs. It also writes a CycloneDX CBOM for the cryptographic bill of materials. Published on PyPI.

pip install pqc-scan

# Fail the build when a non-quantum-safe primitive is introduced.
pqc-scan ./src --format sarif --out results.sarif --fail-on high

Adding it to a workflow takes two steps:

- name: Scan for quantum-vulnerable cryptography
  run: pqc-scan . --format sarif --out results.sarif --fail-on high

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif