Source code
The managed static scanner combines semantic and parser-backed analysis with curated language and protocol rule packs. Native engines are used where they materially improve precision, while specialist and legacy languages retain broad rule-based detection.
| Family | Languages |
|---|---|
| Mainstream backend and systems | Go, C#, Java, Python, Rust, C, C++, Ada |
| Web and scripting | JavaScript, TypeScript, PHP, Ruby, Perl, Shell |
| Scientific and quantum | Julia, Q# |
| Mobile | Kotlin, Swift, Objective-C, Dart |
| Functional and JVM/BEAM | Scala, F#, Clojure, Elixir, Erlang |
| Blockchain | Solidity, Move, Vyper |
| Hardware description | Verilog, VHDL |
| Industrial control | IEC 61131-3 Structured Text |
| Accelerated computing | CUDA, routed through the C++ rule pack |
| Notebooks | Jupyter, preprocessed into Python analysis |
Thirteen configuration and infrastructure formats have first-class routing: YAML, JSON, XML, INI, TOML, environment files, Dockerfile, Terraform/HCL, Bicep, Nginx, Apache, OpenSSL configuration, and OpenSSH configuration. The rule catalog applies those formats to Kubernetes and Helm, CloudFormation and ARM, Envoy, Compose, Ansible, JWT/JWKS, and certificate material.
The curated PQC Rule Pack
Detection and migration intelligence are separate layers. The scanner flags quantum-vulnerable cryptography and the weak-crypto baseline on its own; the curated Rule Pack is an overlay that enriches each detection in place, keyed by rule id.
- NIST and FIPS substitutions — the concrete replacement primitive, for example ML-DSA under FIPS 204.
- Hybrid-PQC guidance for transport and key establishment.
- Vertical context, so the recommendation reflects the sector the workload operates in.
What the rules detect
| Category | Examples |
|---|---|
| Shor-vulnerable public key | RSA key generation and use at any size, DSA, ECDSA and EdDSA signing, ECDH and finite-field DH key agreement, curve parameters |
| Grover-weakened symmetric | AES-128 and shorter keys, short HMAC keys, symmetric parameters that halve under Grover |
| Classically broken | MD5, SHA-1, RC4, DES, 3DES, NULL and EXPORT ciphers, anonymous key exchange, ECB mode, predictable or non-cryptographic RNG |
| Protocol posture | TLS 1.0 and 1.1 enablement, weak cipher strings, JWT and JWS algorithm selection including none and HMAC confusion, SAML signature algorithms, SSH key exchange and host key types, mTLS trust roots |
| Key material | Hard-coded private keys, embedded certificates, key files committed to the tree |
| PQC in use | ML-KEM, ML-DSA, SLH-DSA, and hybrid group configuration — detected and classified, never flagged as a problem |
Dependencies and SBOM
Beyond manifest analysis, the dependency worker ingests full CycloneDX and SPDX SBOMs, so transitive crypto exposure is discovered even when the direct manifest looks clean. Dependency findings flow through the same contract, scoring, and gating pipeline as code findings.
Cloud posture and runtime
Two surfaces exist only in Enterprise, and together they answer a question static analysis cannot: is this cryptography actually deployed, and is it actually running?
| Cloud | Services probed |
|---|---|
| AWS | KMS, ACM, ELBv2, CloudFront, API Gateway, EKS |
| Azure | Key Vault, Application Gateway, Front Door, API Management, App Service, AKS Ingress |
| GCP | Cloud KMS, Certificate Manager, HTTPS Load Balancing, GKE Ingress, API Gateway |
The runtime correlator ingests OTLP traces and Datadog-format logs and joins them against static findings, so you can tell whether flagged cryptography is hot in production or dormant in a code path nobody executes. Correlated evidence is read back per finding at GET /api/v1/findings/{id}/runtime.
Diff-scoped scanning
For fast pull-request pipelines, --diff <git-ref> scans only files changed since a git reference, expanding the change set to include files that import changed files so a change to a crypto helper still surfaces its call sites.
relixq scan --diff origin/main --format sarif -o pr.sarif --exit-on highRelated pages
Scans, findings and reports
The day-to-day working loop: run a scan, read the live progress stream, filter and triage findings, save views, and export evidence.
The CryptoFinding contract
The single schema every scanner normalizes to before its output crosses a boundary — the reason evidence from code, dependencies, TLS, cloud, and runtime composes instead of fragmenting.
TLS endpoint and certificate posture
The read-only TLS surface: endpoint posture rows, certificate inventory, derived issue severities, the honest-empty contract, and the recognized PQC hybrid groups.