Issues

• cbom-fields.md can now cite EO 14412 Sec. 5(d) for the CBOM minimum elements, and three regulatory lines predate NIST IR 8547 final

  csnp/cryptoscan#95 · Filter by author Johnbjoseph-cybersec opened on Nov 9, 2026

• Docs and scan help say detection matches whole words only, but some patterns match inside words

  csnp/cryptoscan#93 · Filter by author thebenignhacker opened on Nov 6, 2026

• --min-severity, --ignore and --ignore-category do not filter dependency findings

  csnp/cryptoscan#92 · Filter by author thebenignhacker opened on Nov 6, 2026

• SARIF gives the removed root's own certificate the chain Fix instead of the finding's Fix

  csnp/cryptoscan#91 · Filter by author thebenignhacker opened on Nov 6, 2026

• CBOM writes the IV-DERIVED-001 and RNG-WEAK-001 misuse findings as algorithm components

  csnp/cryptoscan#89 · Filter by author thebenignhacker opened on Nov 6, 2026

• IV-DERIVED-001 reports node-forge's forge.cipher.createCipher, which takes a separate IV

  csnp/cryptoscan#88 · Filter by author thebenignhacker opened on Nov 6, 2026

• RNG-WEAK-001 matches secret names inside unrelated words, such as iv in div

  csnp/cryptoscan#87 · Filter by author thebenignhacker opened on Nov 6, 2026

• Report says no cryptographic assets were discovered after a baseline removed every finding

  csnp/cryptoscan#85 · Filter by author thebenignhacker opened on Nov 4, 2026

• A relative baseline path in .cryptoscan.yaml is resolved from the working directory, not from the config file

  csnp/cryptoscan#83 · Filter by author thebenignhacker opened on Nov 4, 2026

• parseTrustTable reads a key table with two rows for one key and keeps only the last in bySPKI

  csnp/cryptoscan#80 · Filter by author thebenignhacker opened on Oct 30, 2026

• make lint fails on main while the CI lint job installs an older golangci-lint and passes

  csnp/cryptoscan#79 · Filter by author thebenignhacker opened on Oct 28, 2026

• trustgen writes a table with no rows and exits 0 when the fixtures directory is empty or missing

  csnp/cryptoscan#77 · Filter by author thebenignhacker opened on Oct 27, 2026

• SARIF trust-key absence test lists trustRule, a property name no reporter writes

  csnp/cryptoscan#75 · Filter by author thebenignhacker opened on Oct 27, 2026

• The 'too many lines' case of TestCertificateBlockReadsOnlyWhatOpenSSLReads cannot fail

  csnp/cryptoscan#73 · Filter by author thebenignhacker opened on Oct 26, 2026

• Trust finding pages date the report in Mozilla Bug 2083449 a day before the bug was opened

  csnp/cryptoscan#72 · Filter by author thebenignhacker opened on Oct 26, 2026

• Dependency findings report line 1 of the manifest instead of the line that names the library

  csnp/cryptoscan#41 · Filter by author thebenignhacker opened on Oct 19, 2026

• gate: inline ignore directives are uncounted and cannot be disabled

  csnp/cryptoscan#26 · Filter by author thebenignhacker opened on Oct 18, 2026

• Smaller fixes: scanner, docs, tooling (16 items)

  csnp/cryptoscan#23 · Filter by author thebenignhacker opened on Oct 18, 2026

• v1.5.0 release staging: CHANGELOG retitle and sentences, captures, doc caveats

  csnp/cryptoscan#22 · Filter by author thebenignhacker opened on Oct 18, 2026

• ECC pattern misses OpenSSL ECDSA_ and ECDH_ C API calls because of the word boundary

  csnp/cryptoscan#20 · Filter by author thebenignhacker opened on Oct 17, 2026

• Follow-up fixes after #13 (5 items)

  csnp/cryptoscan#14 · Filter by author thebenignhacker opened on Oct 16, 2026

• Code under examples, fixtures, testdata, docs and similar directories is never reported, with no notice and no flag

  csnp/cryptoscan#10 · Filter by author thebenignhacker opened on Oct 16, 2026

• A .cryptoscan.yaml in the scanned tree can suppress every finding, and no output says so

  csnp/cryptoscan#9 · Filter by author thebenignhacker opened on Oct 16, 2026

• Quality follow-ups from the 2026-10-16 new-user walkthrough (scan output, help text, formats)

  csnp/cryptoscan#7 · Filter by author thebenignhacker opened on Oct 16, 2026