Four evidence sources

cryptarium unifies four repository-resident evidence sources in one scan. Why this matters: Cryptographic choices are scattered across application code, transitive dependencies, embedded certificates, and configuration. An inventory that covers only one of those surfaces leaves migration work blind.

Source	Examples	Method
Source code	Calls into `crypto/rsa`, `cryptography`, OpenSSL, BouncyCastle, Web Crypto, `java.security`; hardcoded key sizes and curves	Rule-pack pattern matching over parsed source (tree-sitter)
Dependencies	Crypto libraries from `go.mod`, `requirements.txt`, `package-lock.json`, `pom.xml`, `Cargo.toml`	Manifest/lockfile parsing against a known-library catalog
Certificates & keys	`.pem`, `.crt`, `.cer`, `.der`, `.p12`, `.jks`, SSH keys	X.509 parsing: signature algorithm, public-key algorithm, key size, curve, validity
Configuration	TLS cipher suites and versions, SSH `KexAlgorithms`, JWT `alg`, IPsec/VPN settings	Config and string pattern matching

Confidence ceilings

A dependency listed in go.mod is medium confidence at most. Correlation with a source finding is what earns high. See Confidence & unknown and Correlation.

What static detectors cannot see

Runtime algorithm selection, dynamically loaded providers, and what gets negotiated on the wire are out of scope for v0.1. Report holes honestly when files fail to parse — silent omission from an inventory is the worst failure mode.