Skip to main content

​
cryptarium

Cryptographic discovery and CBOM generation for the post-quantum transition. One CLI. Four evidence sources. Correlated findings. Standards-based CBOM, SARIF, and a prioritized migration report.

Source

Rule-pack detection over parsed source (tree-sitter).

Dependencies

Manifest and lockfile crypto-library inventory.

Certificates

X.509 and key metadata — algorithm, size, curve, validity.

Configuration

TLS, SSH, JWT, and related crypto settings.
cryptarium finds cryptography in source, dependencies, certificates, and configuration; classifies each use by quantum exposure; and emits a CycloneDX CBOM plus a prioritized migration report. Unlike single-source scanners, it correlates all four evidence sources so a finding is a linked picture — not four disconnected lists.

Install

go install, GitHub Releases, or build from source.

Quickstart

Scan a repo and read your first migration report.

CI & SARIF

Gate builds with --fail-on and upload SARIF to GitHub Security.
Status: v0.1 inventory complete. Core detectors, correlation, scoring, CBOM/SARIF, and the GitHub Action ship on tagged releases. Interfaces may still evolve before 1.0.