Skip to main content

What Cryptarium is not

Credibility depends on never overstating what static discovery can prove.
  • Not a cryptographic correctness auditor. It reports which algorithms are used and their quantum exposure, not whether they are implemented securely (padding, IV reuse, side channels).
  • Not a binary, firmware, or container analyzer (roadmap).
  • Not a runtime or network TLS scanner (roadmap). It sees what code and configuration contain, not what gets negotiated on the wire.
  • Not a multi-ecosystem dependency scanner yet — only go.mod in v0.2.
  • Not an SSH / private-remote cloner yet — public HTTPS only; clone privately yourself and pass a local path, or wait for the roadmap item.
  • Not a replacement for a cryptographer’s judgment on migration design. It surfaces and prioritizes; humans decide.
Static analysis cannot see runtime algorithm selection, dynamically loaded providers, or wire-negotiated suites. The output must never imply otherwise. See Limitations & roadmap.