Documentation

Quickstart

Build the scanner, scan a repository, and read the result. No dependencies, no network calls, nothing uploaded.

Requirements

A C++20 compiler and CMake 3.20 or newer. Nothing else. The scanner has no runtime dependencies, makes no network calls, and writes only the report file you ask for.

Clang 14+, GCC 11+ or MSVC 2022
CMake 3.20+
macOS, Linux or Windows

Build

The scanner lives in the Functor repository under quantum/.

cmake -S quantum -B quantum/build -DCMAKE_BUILD_TYPE=Release
cmake --build quantum/build -j8

That produces a single binary, quantum/build/quantum-scan. To put it on your PATH:

sudo cmake --install quantum/build

To check the build, run the test suite. It covers scoring, suppression, baselines, SARIF and CBOM output.

ctest --test-dir quantum/build

Test project /path/to/quantum/build
      Start  1: scanner_runs_on_sample
 1/7 Test  #1: scanner_runs_on_sample ..........   Passed
 ...
100% tests passed, 0 tests failed out of 7

Your first scan

Point it at a directory. It walks the tree, matches rules, grades each match and writes a Markdown report.

quantum-scan . --out report.md --source-only

--source-only skips tests, vendored code, fixtures and documentation. Start with it: those directories generate most of the first-run noise, and none of it is production cryptography.

The summary is printed to the terminal:

Quantum Core PQ Scanner 0.5.0
-------------------------------------------
Target:             /path/to/project
Output:             report.md
Files scanned:      4

Weakness Score:     100/100 (Critical)
  broken today:     19 finding(s)

Migration Exposure: Pervasive
  asymmetric sites: 12 across 3 file(s) (75% of scanned)

Likely noise:       12

That example is the scanner's own tests/sample_project, which is deliberately full of bad cryptography. A real codebase looks different: scanning Functor's chain core gives a weakness score of 0 with one asymmetric site.

Reading the two scores

The report answers two separate questions and never mixes them.

Measure	Question	Gates CI
Weakness Score 0–100, severity weighted	What cryptography is broken today, on a classical computer? MD5, ECB mode, disabled TLS verification, hardcoded keys.	Yes
Migration Exposure sites, files, % of codebase	How much asymmetric cryptography must move before 2035? RSA, ECDSA, Ed25519, secp256k1, wallet and validator keys.	No

A correct secp256k1 wallet scores 0 weaknesses and Pervasive migration exposure. It passes CI, and the report says it is healthy. A single combined score would have called that repository "Critical", which is how scanners lose the room.

What the report contains

The Markdown report is written to be read by a reviewer and attached to an audit.

Header — target, UTC timestamp, files scanned and skipped.
Both scores, with what each one means.
Executive summary — the weakness/inventory split in plain words.
Quantum reality note — states that hash functions and symmetric primitives are not broken by quantum computers, and that this is a signal scanner, not a proof of vulnerability.
Weaknesses — severity, CWE, rule, file, line and the matched text.
Inventory — the same, with a migration priority instead of a CWE.
Likely noise — low-confidence matches, listed rather than dropped silently, so the suppression is auditable.