quantumscan-io/QuantumScan
Post-quantum cryptography (PQC) vulnerability scanner — detect quantum-vulnerable algorithms, weak entropy, and hardcoded keys before Q-Day
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory to scan (default: repository root) | no | . |
| fail-on | Minimum severity that fails the action: critical | high | medium | low | never | no | high |
| substrate | Enable Substrate/Polkadot PQC patterns (sr25519, BABE, GRANDPA, XCM, ink!, schnorrkel) | no | false |
| no-deps | Skip dependency manifest scanning (package.json, Cargo.toml, go.mod, requirements.txt…) | no | false |
| sarif-output | Write SARIF 2.1.0 report to this path — enables GitHub Security tab integration | no | "" |
Outputs
| name | description |
|---|---|
| risk-score | Quantum risk score 0–100 (0 = quantum-safe, 100 = critical exposure) |
| critical | Number of critical findings |
| high | Number of high findings |
| medium | Number of medium findings |