C#
.cs.cs
Semantic / AST + rulesPlatform coverage
See the cryptography your application stack depends on.
RelixQ connects source-level discovery with dependency, certificate, TLS, cloud, and runtime evidence. Coverage is explicit about how each input is analyzed, so teams can distinguish semantic analysis, language-aware rules, structural decoding, and preprocessing.
31Programming languages
13Config and infra formats
7Evidence input surfaces
3Cloud platforms
Source coverage
31 programming languages, with analysis provenance attached.
Language coverage is more than recognizing an extension. RelixQ records the strongest analysis engine used for each scanned language and retains file, rule, location, confidence, and evidence provenance on every finding.
Semantic / AST + rulesLanguage-aware rules
Backend & systems
8Python
.py.py
Semantic / AST + rulesGo
.go.go
Semantic / AST + rulesJava
.java.java
Semantic / AST + rulesRust
.rs.rs
Semantic / AST + rulesC
.c.c · .h
Semantic / AST + rulesC++
.cpp.cpp · .cc · .cxx · .hpp
Semantic / AST + rulesAda / SPARK
.adb.adb · .ads · .ada
Language-aware rulesWeb & scripting
6JavaScript
.js.js · .jsx · .mjs · .cjs
Semantic / AST + rulesTypeScript
.ts.ts · .tsx
Semantic / AST + rulesPHP
.php.php · .phtml
Semantic / AST + rulesRuby
.rb.rb
Semantic / AST + rulesPerl
.pl.pl · .pm · .t
Language-aware rulesShell
.sh.sh · .bash · .zsh · .ksh
Language-aware rulesMobile & client
4Kotlin
.kt.kt · .kts
Semantic / AST + rulesSwift
.swift.swift
Semantic / AST + rulesObjective-C / Objective-C++
.m.m · .mm
Language-aware rulesDart / Flutter
.dart.dart
Language-aware rulesFunctional & scientific
7Scala
.scala.scala · .sc
Semantic / AST + rulesJulia
.jl.jl
Semantic / AST + rulesF#
.fs.fs · .fsi · .fsx
Language-aware rulesClojure / ClojureScript
.clj.clj · .cljs · .cljc · .edn
Language-aware rulesElixir
.ex.ex · .exs
Language-aware rulesErlang
.erl.erl · .hrl
Language-aware rulesQ#
.qs.qs
Language-aware rulesBlockchain
3Solidity
.sol.sol
Language-aware rulesMove
.move.move
Language-aware rulesVyper
.vy.vy
Language-aware rulesHardware & industrial
3Verilog / SystemVerilog
.v.v · .vh · .sv · .svh
Language-aware rulesVHDL
.vhd.vhd · .vhdl
Language-aware rulesIEC 61131-3 Structured Text
.st.st · .iecst
Language-aware rulesSpecialized route
Jupyter notebooks
Notebook code cells → Python semantic analysis
RelixQ extracts executable cells from .ipynb files and reports findings under Python, preserving the notebook and cell context.
Specialized route
CUDA
.cu and .cuh → C++ semantic analysis
CUDA source follows the C++ analysis route so host-side and GPU-oriented cryptographic call sites share one evidence model.
Specialized route
Certificates and key material
PEM, DER, CRT, CER and key files → X.509 decoder
Dedicated structural parsing records public-key and signature algorithms instead of treating certificate material as plain text.
Specialized route
JWK and SAML material
JWKS and SAML metadata → protocol decoders
RelixQ decodes JWK parameters, JWS headers and SAML signature metadata to surface algorithm and key posture.
Configuration and infrastructure
Cryptography is often configured, not called.
RelixQ follows TLS, key, provider, cipher, identity, and certificate choices into the configuration and infrastructure files that determine production behavior.
YAML
Config-awareKubernetes, Helm, Ansible and service configuration
JSON
Config-awareCloud templates, application configuration and policy
XML
StructuralSAML metadata and application configuration
INI / CFG
Config-awareService and platform configuration
TOML
Config-awareApplication, build and dependency configuration
Environment files
Config-aware.env variants and runtime configuration
Dockerfile / Containerfile
Config-awareContainer build and runtime posture
Terraform / HCL
Config-awareCloud infrastructure and provider configuration
Bicep
Config-awareAzure infrastructure and deployment parameters
Nginx
Config-awareTLS protocol, cipher and certificate configuration
Apache HTTP Server
Config-awareTLS protocol, cipher and certificate configuration
OpenSSL configuration
Config-awareProviders, algorithms, policies and FIPS settings
OpenSSH configuration
Config-awareHost keys, key exchange and cipher policy
Seven evidence input surfaces
From a source line to the service that runs it.
Every input surface normalizes into one evidence model. The readiness graph then correlates those observations so teams can deduplicate cryptographic assets, preserve provenance, trace blast radius, and prioritize migrations by exposure rather than raw finding volume.
- SURFACE 01
Source code
Discover cryptographic APIs, algorithms, key sizes, protocol choices, embedded material and migration targets across the source estate.
Evidence carried
Repository, file, line, rule, engine provenance and confidence
- SURFACE 02
Configuration and infrastructure
Follow cryptographic policy into service, container, proxy, identity, and infrastructure definitions that determine deployed behavior.
Evidence carried
Format, resource or directive, environment context, rule, location and confidence
- SURFACE 03
Dependencies and SBOMs
Analyze direct manifests and transitive exposure supplied through complete CycloneDX and SPDX software bills of materials.
Evidence carried
Package identity, version, dependency path and cryptographic role
- SURFACE 04
Certificates and TLS endpoints
Observe protocol versions, cipher suites, certificate chains, key and signature algorithms, expiry and hybrid-PQC negotiation.
Evidence carried
Host, port, negotiated parameters, certificate fingerprint and observation time
- SURFACE 05
Cloud key management
Inventory managed keys and evaluate algorithms, rotation, aliases, use context and exposure across the three major clouds.
Evidence carried
Provider resource identifier, region, algorithm, rotation and ownership
- SURFACE 06
Cloud TLS infrastructure
Connect certificates and transport posture to load balancers, gateways, edge delivery and managed Kubernetes ingress.
Evidence carried
Cloud service, listener, certificate binding, endpoint and environment
- SURFACE 07
Runtime telemetry
Correlate OTLP traces and operational signals with static findings to distinguish cryptography that executes from dormant paths.
Evidence carried
Service, environment, trace correlation, last observed time and activity
Correlation layer
Readiness graph
Join source, configuration, dependency, TLS, cloud, and runtime observations into canonical assets for blast radius and migration sequencing.
Evidence carried
Asset relationships, provenance, HNDL context, owners and downstream impact
Cloud and service coverage
Connect managed keys to the infrastructure serving traffic.
Cloud posture joins key-management evidence with certificate bindings, listeners, gateways, edge delivery, application hosting, and Kubernetes ingress.
Cloud platform
AWS
Keys and certificates
- AWS KMS
- AWS Certificate Manager
Traffic and delivery
- Elastic Load Balancing v2
- CloudFront
- API Gateway
- EKS ingress
Cloud platform
Microsoft Azure
Keys and certificates
- Azure Key Vault
Traffic and delivery
- Application Gateway
- Front Door
- API Management
- App Service
- AKS ingress
Cloud platform
Google Cloud
Keys and certificates
- Cloud KMS
- Certificate Manager
Traffic and delivery
- Cloud Load Balancing
- GKE ingress
- API Gateway
Standards and artifacts
Evidence enters and leaves in formats your program can use.
RelixQ uses open security and telemetry contracts for interoperability while carrying NIST post-quantum standards as structured migration targets. Standards alignment describes product evidence—it is not a certification claim.
Interchange and identity
SARIF 2.1.0
Portable findings with severity, tags, help and stable fingerprints
CycloneDX SBOM
Direct and transitive software dependency evidence
SPDX SBOM
Software package and dependency evidence
CycloneDX 1.6 CBOM
Portable cryptographic asset inventory that can be ingested, enriched, and exported per project
OCSF
Normalized security findings for SIEM correlation
OpenTelemetry
Runtime correlation plus metrics and event delivery
JSON Schema 2020-12
Versioned finding and integration contracts
OIDC, SAML 2.0 and SCIM 2.0
Enterprise identity, federation and lifecycle provisioning
Post-quantum transition
PQC standard
FIPS 203 — ML-KEM
Structured migration target for key establishment
PQC standard
FIPS 204 — ML-DSA
Structured migration target for digital signatures
PQC standard
FIPS 205 — SLH-DSA
Structured migration target for hash-based signatures
Migration guidance
NIST IR 8547
Transition planning context for deprecating quantum-vulnerable standards
Evidence boundary
RelixQ produces measured, dated and sourced evidence for review. Product coverage and framework mappings do not constitute an attestation, certification, or legal opinion.
Evaluate your estate
Bring a representative application portfolio.
Scope source ecosystems, cloud services, TLS endpoints, evidence formats, and operating workflows in one bounded evaluation.