Connect QuantumReady to your workflow

Inventory and remediation

Review the latest retained scan for each asset, assign a person and a target date, and compare two reports. Limited coverage remains visible.

CI checks and code scanning

The repository includes a GitHub composite action and a CI command that writes JSON, CycloneDX CBOM and SARIF. Choose the risk labels that should fail your check. Incomplete scans have a separate exit code.

QR_TARGET=./your-project QR_OUTPUT=quantumready-results \
  QR_FAIL_ON=deprecated-weak node scripts/ci-scan.mjs

Run from a QuantumReady checkout with Node 22 and dependencies installed. Private action distribution requires repository access. No issues, comments or tickets are posted automatically.

GitHub issue drafts and ticket export

Export GitHub-ready issue titles and bodies with review steps and acceptance criteria. Nothing is posted automatically.

Download a CSV from your inventory containing summary, description, priority, assignee, target date and status. Import it into your ticketing system after reviewing its field mapping.

This is a file export. It does not imply a live Jira or ServiceNow connection.

Runtime observations for Node applications

Use the optional collector in a test or staging process to record successful Node crypto operations. It records algorithm names and operation labels, without keys, messages, plaintext or outputs.

QR_TRACE_FILE=./crypto-events.jsonl \
  node --require ./runner/node-trace.cjs ./your-app.js
qr-run runtime ./crypto-events.jsonl --asset your-service --json

Try it in staging before production. Coverage is limited to intercepted Node crypto operations during that run. WebCrypto, native addons, Java and other processes are not covered by this collector. Uploaded traces remain customer-supplied evidence.

TLS and SMTP STARTTLS

The runner completes TLS sessions and inventories certificates, including TLS 1.3. Chain trust, hostname matching and validity dates are reported separately.

qr-run endpoint your-domain.example --port 443
qr-run endpoint mail.your-domain.example --port 587 --starttls smtp

Cloudflare-hosted probes still have network reachability restrictions. Use --ca company-ca.pem --crl issuer-crl.pem for a private trust root and a supplied CRL. Revocation is otherwise unmeasured; OCSP staple presence alone is not a validated result. Use --enumerate-ciphers for bounded, individual TLS 1.2 suite probes supported by the client runtime. This is not a universal cipher audit.

Authenticated API

Runner clients can use their activation key in the x-qr-activation header. Account-scoped endpoints include inventory, report comparison and remediation. Private reports require ownership or a valid report-access token.

GET /api/inventory
GET /api/reports/compare?before=REPORT_ID&after=REPORT_ID
GET /api/remediation/export