Skip to content

Add QuantumScan to Testing section#135

Open
gaiabio12-design wants to merge 1 commit into
devsecops:masterfrom
gaiabio12-design:add-quantumscan
Open

Add QuantumScan to Testing section#135
gaiabio12-design wants to merge 1 commit into
devsecops:masterfrom
gaiabio12-design:add-quantumscan

Conversation

@gaiabio12-design
Copy link
Copy Markdown

Adding QuantumScan to the ## Testing section, listed alphabetically between PureSec and RetireJS.

QuantumScan is a free post-quantum cryptography scanner for GitHub repositories. It complements other security scanners listed here (Snyk, Checkov, ShiftLeft Scan) by focusing specifically on the cryptographic-asset inventory that DORA (EU 2022/2554) now requires from financial entities and NIS2 mandates for essential/important entities across 18 sectors.

Key features:

  • CycloneDX 1.7 CBOM export (cryptographic-asset inventory format recommended by CISA)
  • DORA / NIS2 compliance PDF with mapped Article-level findings
  • AI-generated migration guides per finding pointing to NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA)
  • Slack drift alerts when new vulnerable algorithms appear between scans
  • Privacy-first: scanner-core is MIT-licensed at https://github.com/quantumscan-io/scanner-core

The hosted version is free during the design partner phase. Fits the DevSecOps testing workflow as a static analysis step that maps directly to current regulatory frameworks (DORA active since Jan 2025).

Following the alphabetical convention of the section.

@gaiabio12-design
Copy link
Copy Markdown
Author

Hi! Just a gentle reminder on this submission. Happy to make any adjustments if needed. Thanks for maintaining this list!

@gaiabio12-design
Copy link
Copy Markdown
Author

Quick update: QuantumScan just merged its first community contribution — a developer independently added .NET / C# detection patterns (System.Security.Cryptography + BouncyCastle.NET). The project is MIT-licensed, community-driven, and the scanner-core is fully open source at github.com/quantumscan-io/scanner-core. Happy to address any feedback.

@gaiabio12-design
Copy link
Copy Markdown
Author

Hi! Friendly ping on this PR.

Since the original submission, scanner-core has shipped several updates:

  • Multi-language support now covers 12 languages including C# / .NET
  • GitHub PR bot for automated PQC scanning on every pull request
  • CycloneDX 1.7 CBOM export and DORA/NIS2 compliance PDF reports
  • npx quantumscan . — no install, runs locally, code never leaves the machine

If there's any change needed to match the list's guidelines, happy to update. Thanks for maintaining this resource!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant