This page lists what CryptoScan already does and what the maintainers plan next; for installation and a first scan, start with the README.
Status as of 2026-10-18, when 1.4.0 is the latest release. What each release changed, and its known limitations, is in CHANGELOG.md.
- Local and remote repository scanning
- 90+ cryptographic patterns
- Multiple output formats (text, JSON, CSV, SARIF, CBOM)
- Context-aware analysis with confidence scoring
- Dependency scanning of package.json, requirements.txt, pyproject.toml, go.mod, pom.xml, Cargo.toml and Gemfile
- Parallel scanning with worker pools
- Inline ignore comments
- Post-Quantum Cryptography detection (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, XMSS, LMS)
- Hybrid cryptography recognition (X25519+ML-KEM, composite signatures)
- Comprehensive MAC detection (HMAC, KMAC, CMAC, GMAC, Poly1305)
- KDF detection (HKDF, PBKDF2, Argon2id, scrypt, bcrypt)
- Migration Readiness Score with visual dashboard
- QRAMM framework integration (CVI Dimension mapping)
- Certificate detection (X.509, CSR, PKCS#12, chains, mTLS, JWK)
- Certificate validation bypass detection (CRITICAL severity)
- Weak certificate signature detection (SHA-1/MD5)
- Enhanced false positive reduction with smart context analysis
- CI/CD flexibility with
--ignore,--ignore-category,--fail-on,--baseline - Configuration file support (
.cryptoscan.yaml) - Pattern-specific inline suppression (
cryptoscan:ignore RSA-001) - Baseline comparison for tracking new findings only
- Enhanced CBOM output (CycloneDX 1.6 cryptoProperties), shipped in 1.4.0
- Smart remediation engine with language-specific recommendations, on main and not yet in a release. Where the engine has text for the algorithm in the file's language, the finding's
Fix:line names the change, for exampleReplace hashlib.md5() with hashlib.sha256()in Python. - Git history scanning (find crypto in past commits). There is no flag for it yet;
scanreads the working tree.
- AWS resource scanning (KMS, ACM, Secrets Manager)
- Azure resource scanning (Key Vault, App Configuration)
- GCP resource scanning (Cloud KMS, Secret Manager)
- Infrastructure-as-Code analysis (Terraform, CloudFormation, Pulumi)