Detectors overview

Cryptarium looks for cryptography in four places. Source coverage is mostly YAML rule packs, not hardcoded Go. What you will do next: skim this page, then add a rule when you need a new API covered.

The four places

Detector	Looks at	You get
Source	Go, Python, JS/TS, Java, C/C++ via rule packs (OpenSSL, libsodium, mbedTLS, Crypto++, Botan, …)	Call sites, algorithm names, parameters
Dependencies	`go.mod` + library catalog	Crypto libraries present (not proof of use)
Certificates	PEM, DER, PKCS#12 files	Algorithms, sizes, curves, validity (metadata only)
Configuration	nginx TLS, SSH, JWT `alg`, similar	Configured suites and algorithms

A library listed in go.mod is medium confidence at most until it correlates with a source finding. See Confidence.

From file to report

Detect evidence in those four places.
Correlate related hits (for example a dependency and a matching call).
Classify quantum risk (Broken / Weakened / Safe / Unknown).
Score priority and emit CBOM, SARIF, or a Markdown report.

Rules find evidence. They do not decide quantum risk. That stays in the classifier so claims stay citation-backed.

Extend coverage

Goal	Start here
New API in source	Adding a rule
How packs load and what fields mean	Rule packs
Prove a rule with fixtures	Fixtures & validation

Prefer YAML for a new library call. Prefer a Go detector only for real parsers (certs) or format-aware config.