Code Analyzer

Static analysis for quantum-vulnerable cryptography in source code. Scans individual files or entire project directories with real-time streaming progress.

Supported Languages

What Gets Detected

Quantum-Vulnerable Algorithms (PQC Mode)

Scanning a Project

File Selection

Configure which files are scanned in Settings → Code Analysis:

• File Extensions — select which extensions to include. Defaults to all supported languages. Deselect extensions to skip file types you don't care about.
• Excluded Directories — directories skipped during scanning. Defaults include node_modules, .git, venv, dist, build, __pycache__, and other common build/dependency directories.

Streaming Progress

Directory scans use Server-Sent Events (SSE) to stream results in real time. Files are processed in batches grouped by language so language-specific rules are applied correctly. Batch sizes adapt to project size:

Findings appear in the UI as each batch completes. The progress bar shows files scanned vs total.

Cancellation

Click Cancel during a scan to stop it. Partial results are saved to history and marked as Partial — findings collected up to the cancellation point are preserved and viewable.

Result Fields Explained

Finding Summary

Per-Finding Fields

Severity Levels

AI-Powered Fixes

Requires an LLM API key configured in Settings → AI Configuration. Two modes are available, selectable in Settings:

If AI is disabled or no LLM key is configured, a Generate Recommendation button appears instead. This uses the rule autofix field (extra.fix) where available, or calls a backend rule-based recommender — no LLM required.

Reviewing a Fix

1. Click the generate button on any finding — a loading indicator appears while the fix is generated
2. Click View Recommendation or View AI Code Fix to review the diff
3. Apply the changes manually to your code, or use Regenerate to produce a new suggestion
4. Click Discard to remove the suggestion and start fresh

Rule Sources

Rules are bundled with the application and organized by language. No internet connection is required for scanning.

Adding Custom Rules

Place custom OpenGrep YAML rules in rules/custom-rules/. They are picked up automatically on the next scan. Example:

rules:
  - id: custom-weak-cipher
    pattern: Cipher.getInstance("DES")
    message: DES is quantum-vulnerable. Replace with AES-256-GCM.
    severity: ERROR
    languages: [java]
    metadata:
      quantum_vulnerable: true

Setting quantum_vulnerable: true in metadata ensures the finding appears in PQC-only scan mode.

Scan History

Every scan is saved to history. Directory scans are stored as a single record grouping all findings. Individual file scans are stored separately.

• Complete scans — all files processed, full findings available
• Partial scans — cancelled or errored scans, marked with a Partial badge. Findings collected before cancellation are preserved.
• Clean files — files with no findings are stored in a separate table and lazy-loaded on demand to keep scan records small

Performance Notes

• The scanner is invoked once per language per batch — not once per file. This is significantly faster than per-file invocation.
• For large projects (>100 files), the scan runs as a single directory invocation per language group.
• Scan timeout is 120 seconds by default. Individual batches have a 600-second hard timeout.
• The scanner is bundled with the application for air-gapped environments — no internet connection required for scanning.
• The scanner ignores .gitignore by default so all files are scanned. Use the Excluded Directories setting to control what's skipped.

Relationship to Other Analyzers

The Code Analyzer finds quantum-vulnerable cryptography in source code — before it is compiled. The Binary Analyzer finds the same vulnerabilities in compiled binaries — useful when you don't have source access. For live infrastructure, the Certificate Analyzer and Network Analyzer assess deployed TLS configurations.

The Code Analyzer does not produce a 0–100 Quantum Risk Score — findings are reported at the individual rule level with severity. For a unified risk score, use the Certificate or Binary analyzers.