> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cryptarium.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Four evidence sources

> Source, dependencies, certificates, and configuration — what each detector sees and what it cannot.

# Four evidence sources

`cryptarium` unifies four repository-resident evidence sources in one scan.

**Why this matters:** Cryptographic choices are scattered across application code, transitive dependencies, embedded certificates, and configuration. An inventory that covers only one of those surfaces leaves migration work blind.

| Source                  | Examples                                                                                                                    | Method                                                                              |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| **Source code**         | Calls into `crypto/rsa`, `cryptography`, OpenSSL, BouncyCastle, Web Crypto, `java.security`; hardcoded key sizes and curves | Rule-pack pattern matching over parsed source (tree-sitter)                         |
| **Dependencies**        | Crypto libraries from `go.mod`, `requirements.txt`, `package-lock.json`, `pom.xml`, `Cargo.toml`                            | Manifest/lockfile parsing against a known-library catalog                           |
| **Certificates & keys** | `.pem`, `.crt`, `.cer`, `.der`, `.p12`, `.jks`, SSH keys                                                                    | X.509 parsing: signature algorithm, public-key algorithm, key size, curve, validity |
| **Configuration**       | TLS cipher suites and versions, SSH `KexAlgorithms`, JWT `alg`, IPsec/VPN settings                                          | Config and string pattern matching                                                  |

## Confidence ceilings

A dependency listed in `go.mod` is **medium** confidence at most. Correlation with a source finding is what earns **high**. See [Confidence & unknown](/concepts/confidence) and [Correlation](/concepts/correlation).

## What static detectors cannot see

Runtime algorithm selection, dynamically loaded providers, and what gets negotiated on the wire are out of scope for v0.1. Report holes honestly when files fail to parse — silent omission from an inventory is the worst failure mode.