Platform overviewCryptographic inventoryCBOMCrypto agilityPQC migrationCI drift control
All solutionsFinancial servicesGovernmentHealthcareSoftware companies
SecurityPricing
GuidesPQC migration guideNIST PQC standardsCryptographic inventoryCompareIntegrations
Start a scanSee the platformSign in

Cryptography code scanner

Find cryptographic use in code without treating regex as proof

Qubrisk is a local-first cryptography scanner built for repeatable inventory and migration work. It preserves the evidence needed for review while explicitly representing uncertainty.

Start a scan See pricing

Decision brief

Primary query
cryptography code scanner
Best for
Teams that need reviewable cryptographic evidence, ownership, and continuous migration control.
Safety boundary
Evidence supports decisions; it is not proof of implementation safety or compliance.

Cryptography discovery in software is difficult because the same API may support many algorithms, wrappers hide configuration, dependency behavior changes by version, and strings can be examples rather than executable use. A responsible scanner must combine multiple evidence sources and make confidence visible. It should never convert a pattern match into a claim that code is vulnerable or safe without the necessary context.

Qubrisk scans locally and emits metadata, redacted evidence, locations, identifiers, and open artifacts. Findings can be reviewed in the dashboard or delivered as SARIF in code review. Dependency and configuration evidence is retained alongside source observations so an engineer can reproduce the finding and decide whether it represents active cryptography, dead code, test material, or an unresolved unknown.

Capabilities

What the operating model needs to do

01

Local execution

Keep source in the organization’s environment while producing approved metadata and evidence.

02

Layered detection

Combine source, dependency, configuration, container, and endpoint observations.

03

Reviewable confidence

Show why a finding is confirmed, probable, or unresolved and let reviewers correct it.

04

Developer outputs

Generate SARIF for code review and CycloneDX CBOM for inventory interchange.

Workflow

A repeatable path to evidence

Use explicit scope, accountable decisions, and verification gates. Keep unknowns visible so progress is not manufactured by narrowing the denominator.

  1. 1

    Configure scope

    Select repositories, paths, exclusions, rule bundle, and whether authorized endpoint checks are allowed.

  2. 2

    Run locally

    Index relevant files and create redacted evidence without sending full source to Qubrisk.

  3. 3

    Review findings

    Inspect exact locations, dependencies, confidence, and policy context before assigning work.

  4. 4

    Gate drift

    Run the scanner in CI and compare proposed changes with an accepted baseline.

Expected deliverables

Artifacts the next team can inspect

  • Location-level cryptography findings
  • Redacted supporting evidence
  • Dependency and configuration context
  • SARIF and CycloneDX CBOM
  • Repeatable CI diff

Buyer checklist

Questions for a proof of value

  1. 01What leaves the build environment?
  2. 02How are false positives and unknowns handled?
  3. 03Can rules and scanner versions be pinned?
  4. 04Does the tool scan dependencies and configuration as well as source?
  5. 05Can findings become owned work instead of another report?

Limits and cautions

What this page does not promise

  • Static discovery cannot prove runtime reachability.
  • A scanner should not collect private keys or unredacted secrets.
  • Human and interoperability review remain necessary for cryptographic replacement.

Continue evaluating

Related decision pages

Certificate inventory

Connect certificate inventory to cryptographic context and ownership

Inventory approved TLS endpoints and certificate observations alongside algorithms, protocols, repositories, owners, policy, and post-quantum migration work.

Read page

Cryptographic inventory software

A cryptographic inventory your engineering teams can keep current

Discover cryptographic assets in source, dependencies, configuration, containers, and authorized TLS endpoints. Preserve evidence, ownership, and change history in one inventory.

Read page

Cryptographic asset management

Manage algorithms, certificates, libraries, and dependencies as operational assets

A cryptographic asset management platform for inventory, ownership, policy, exceptions, migration work, and evidence that stays connected to engineering systems.

Read page

Implementation guide

How to build and maintain a cryptographic inventory

A practical guide to inventory scope, evidence, asset identity, confidence, ownership, CBOM export, continuous discovery, and migration use.

Read page
Local-first discovery

Start with evidence from one representative repository

Run a scoped scan, inspect every result, export the CBOM, and decide whether the evidence is strong enough to support your operating model.

Create a workspace