Skip to main content
RelixQ
Menu

The CryptoFinding contract

The single schema every scanner normalizes to before its output crosses a boundary — the reason evidence from code, dependencies, TLS, cloud, and runtime composes instead of fragmenting.

Schema
JSON Schema 2020-12
Export
SARIF 2.1.0 compatible
Browse the Developer Guide

Why one shape

Every scanner — code, dependency, TLS, and in Enterprise also cloud posture and runtime telemetry — normalizes its output to one schema before it crosses a service boundary. Most of what either product can do downstream follows from that.

That is why the findings list, risk scoring, dashboards, graph analysis, governance, and reports all speak the same language regardless of where a finding came from — and why a finding produced by the CLI is legible to the tenant that ingests it.

The schema

jsonc
{
  "findingId": "uuid-v7",
  "organizationId": "uuid",
  "projectId": "uuid",
  "scanId": "uuid",
  "ruleId": "GO_RSA_GENERATE_KEY",
  "algorithm": "RSA",
  "keySize": 2048,
  "severity": "high",
  "filePath": "internal/auth/token.go",
  "lineNumber": 42,
  "evidence": "rsa.GenerateKey(rand.Reader, 2048)",
  "serviceId": "uuid",
  "exposure": "external",
  "environment": "prod",
  "owner": "team-platform",
  "usageType": "signing",
  "confidence": 0.95,
  "recommendation": "Migrate to ML-DSA-65 (Dilithium-3) for new signatures...",
  "status": "open",
  "createdDate": "2026-05-12T08:00:00Z",
  "lastSeenDate": "2026-05-12T08:00:00Z"
}
Field groupFieldsQuestion answered
IdentityfindingId, organizationId, projectId, scanId, ruleIdWhich finding, in whose tenant, from which run and rule?
Whatalgorithm, keySize, usageType, evidence, languageWhat cryptography was found, and how is it used?
WherefilePath + lineNumber, serviceId, environment, exposureWhere does it live, and how reachable is it?
Assessmentseverity, confidence, quantum-safety classification, recommendationHow bad is it, how sure are we, and what replaces it?
Lifecyclestatus, owner, createdDate, lastSeenDateWho owns it, and where is it in triage?

Quantum-safety classification

Severity describes how weak the cryptography is. The quantum-safety classification describes what kind of work fixing it implies. They are deliberately different axes, and every finding carries both.

ClassificationWhat lands hereThe work it implies
vulnerablePublic-key cryptography broken by Shor: RSA, DSA, ECDSA, EdDSA, ECDH, DHA real PQC migration — swap to ML-KEM or ML-DSA, or a hybrid. This is the migration backlog.
classically_brokenHashes, ciphers, and RNGs already broken today: MD5, SHA-1, RC4, DES, 3DESReal remediation, but not a public-key PQC migration. Do not let it inflate the migration estimate.
grover_weakenedSymmetric parameters halved in effective strength, for example AES-128Parameter increase, not algorithm replacement.
hybridA classical primitive combined with a PQC one, for example X25519 + ML-KEM-768Nothing. This is the recommended transition state.
quantum_safeA NIST PQC primitive already in use: ML-KEM, ML-DSA, SLH-DSANothing. This is the column you want to grow.
unknownQuantum safety could not be determined from the evidenceA human look. Not safe, not proven unsafe.

Findings carry no source code

Two consequences worth knowing. The finding detail page renders a representative code sample for the language and algorithm rather than a live read of your file — open path:line in your editor for the real code. And when results are submitted to a workspace, what travels is findings metadata: algorithm, path, line, severity. Never your repository.

SARIF export

RelixQ emits SARIF 2.1.0 with --format sarif. The output carries security-severity, tags, per-rule help text, and stable fingerprints, and uploads directly to GitHub Code Scanning and most other AppSec tooling.

console
relixq scan /path/to/repo --format sarif > relixq.sarif

Stable fingerprints are what make baselines and base-versus-head diffs work: a finding is matched by rule plus file plus code snippet, so it survives line-number drift from unrelated edits. See the release gate.

Related pages