Output formats

Four formats, one scan. Every example below is real output from quantum/tests/sample_project, a fixture written to contain bad cryptography on purpose.

Format	For	Typical use
markdown	People	Review, and an artifact to attach to an audit.
json	Machines	Automation, dashboards, and baseline input.
sarif	GitHub	Code scanning alerts and pull-request annotations.
cbom	Auditors	CycloneDX 1.6 cryptographic inventory (ECMA-424).

Markdown

quantum-scan . --out report.md --source-only

A complete audit artifact: header, both scores, an executive summary, a note on what quantum computers do and do not break, then the weaknesses, the inventory and the likely noise.

# Quantum Core Post-Quantum Readiness Report

**Target:** `/path/to/sample_project`
**Generated:** 2026-09-23 07:07:40 UTC
**Files scanned:** 4

| Measure | Value | Meaning |
|---|---|---|
| **Weakness Score** | **100/100 (Critical)** | Cryptography that is broken today. Gate CI on this. |
| **Migration Exposure** | **Pervasive** | 12 asymmetric site(s) across 3 file(s), 75% of files scanned. |

## Weaknesses — Act Now

| Severity | CWE | Rule | File | Line | Match |
|---|---|---|---|---:|---|
| `high` | CWE-328 | `CRYPTO-HASH-BROKEN-001` | `crypto_misuse.py` | 14 | `hashlib.md5` |

JSON

quantum-scan . --format json --out quantum.json --source-only

Top level: schema_version, tool, target, generated, summary and findings. This is also the format a --baseline file must be in.

"summary": {
  "files_scanned": 4,
  "matches_total": 50,
  "findings_reportable": 38,
  "findings_noise": 12,
  "baselined": 0,
  "suppressed_inline": 0,
  "weakness_score": 100,
  "weakness_band": "Critical",
  "weakness_count": 19,
  "migration_sites": 12,
  "migration_files": 3,
  "migration_coverage_percent": 75,
  "migration_band": "Pervasive",
  "by_class": { "inventory": 19, "weakness": 19 },
  "by_severity": { "critical": 12, "high": 17, "info": 5, "medium": 4 }
}

Each finding carries everything needed to triage it without opening the file, plus a stable fingerprint for baselining.

{
  "fingerprint": "38bb266c357dce6b",
  "baselined": false,
  "rule_id": "CRYPTO-HASH-BROKEN-001",
  "title": "Broken hash function used",
  "class": "weakness",
  "severity": "high",
  "confidence": "high",
  "reportable": true,
  "cwe": "CWE-328",
  "references": [
    "CWE-328: Use of Weak Hash",
    "NIST SP 800-131A Rev. 2 (SHA-1 disallowed for digital signatures)",
    "OWASP ASVS V6.2"
  ],
  "migration_priority": "medium",
  "tags": ["weak-hash", "collision", "immediate-risk"],
  "file": "crypto_misuse.py",
  "line": 14,
  "matched_pattern": "hashlib.md5",
  "source_line": "return hashlib.md5(password.encode()).hexdigest()",
  "description": "MD5 and SHA-1 are collision-broken...",
  "recommendation": "Replace with SHA-256, SHA-512, or SHA-3..."
}

SARIF 2.1.0

quantum-scan . --format sarif --out quantum.sarif --source-only

Findings become native code scanning alerts in the GitHub Security tab and inline annotations on pull requests. The full rule set is emitted in tool.driver.rules, so every alert carries its description and recommendation.

{
  "ruleId": "CRYPTO-HASH-BROKEN-001",
  "ruleIndex": 0,
  "level": "error",
  "message": { "text": "Broken hash function used (weakness, confidence high). Matched `hashlib.md5`. Replace with SHA-256..." },
  "partialFingerprints": { "quantumFingerprint/v1": "38bb266c357dce6b" },
  "locations": [
    { "physicalLocation": {
        "artifactLocation": { "uri": "crypto_misuse.py" },
        "region": { "startLine": 14 } } }
  ]
}

CycloneDX 1.6 CBOM

quantum-scan . --format cbom --out quantum-cbom.json --source-only

A Cryptographic Bill of Materials, published as ECMA-424: the inventory format auditors and crypto-agility tooling consume, and the basis of NIST IR 8547 migration planning. It is an inventory, not a finding list. MD5 found in forty files is one component with forty occurrences.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d8fc500f-9e69-4e87-bd0d-c7d05630b0de",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-23T07:07:49Z",
    "component": { "type": "application", "bom-ref": "scan-target", "name": "sample_project" },
    "properties": [
      { "name": "quantum:filesScanned", "value": "4" },
      { "name": "quantum:cryptographicAssets", "value": "12" }
    ]
  }
}

Each algorithm becomes one cryptographic-asset component, with its primitive, its functions, its classical security level and its NIST post-quantum security category.

{
  "type": "cryptographic-asset",
  "bom-ref": "crypto/algorithm/3des",
  "name": "Triple DES",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "block-cipher",
      "cryptoFunctions": ["encrypt", "decrypt"],
      "classicalSecurityLevel": 112,
      "nistQuantumSecurityLevel": 0
    },
    "oid": "1.2.840.113549.3.7"
  },
  "evidence": {
    "occurrences": [ { "location": "crypto_misuse.py", "line": 42 } ]
  },
  "properties": [
    { "name": "quantum:occurrenceCount", "value": "1" },
    { "name": "quantum:migrationPriority", "value": "medium" }
  ]
}

RSA, ECDSA, Ed25519 and ECDH all report nistQuantumSecurityLevel: 0, meaning they meet none of the NIST post-quantum categories. That is the field an auditor filters on.