QuantumReadyRun a PQS scan
This is a PQS scan: a post-quantum security check of a public endpoint or a public repository, and both are free. Give us a domain and the scanner performs a real TLS handshake, then reports whether your edge already supports a post-quantum hybrid key exchange. Point it at a repository for a hosted scan of up to 250 files or 2 MiB of source, whichever comes first, with its limits and observed findings stated. Repositories larger than the budget are reported as partial. An account is only needed to save your work, and to scan private code, which the offline scanner does inside your own network.
Public endpoint scan
We open a real TLS 1.3 handshake against your domain and report whether your edge supports post-quantum hybrid key exchange. This is the same measurement a sophisticated customer would run on you, so it is worth knowing the answer before they do.
No signup. No access to your systems.
The endpoint scan sees public transport encryption only. It cannot see the cryptography inside your applications, internal services, certificates or key stores. For that, run a repository scan or talk to us about internal discovery.
Bulk certificate scan
Paste up to twelve hostnames, one per line. We check each one and build a certificate register you can send straight to the workbench: key algorithm, key size, signature algorithm, expiry and protocol support for every host.
Runs a quick scan on each host. Certificates are read from the TLS 1.2 handshake.
Repository scan
Hosted scans read up to 250 files or 2 MiB of source, whichever comes first, inside the free Workers budget, and they read code as well as text within that budget. A repository larger than the budget is reported as partial, and the local scanner has a larger budget and reads more of the same repository.
Point us at a public GitHub or GitLab repository. We download the source, filter it, detect cryptographic primitives across a dozen language families and file types, classify each one by quantum risk, and build a cryptographic bill of materials with file and line evidence.
Public repositories only. Reports and temporary scan checkpoints can contain matched source excerpts and file paths.
What this scan can and cannot see
This hosted deployment scans up to 250 files or 2 MiB of source, whichever comes first, and reads code as well as text within that budget. A repository larger than the budget is reported as partial. The local runner has a larger source budget and parses eleven language families, including Java, JavaScript and TypeScript, Python, Go, Ruby, PHP, Rust, C# and C++. Every report states its limits; unmeasured or skipped code must not be treated as safe.
Private repositories need an account
Link GitHub, GitLab or Bitbucket and we fetch your private repositories and scan them for you, keeping the report on your account. Part of the Team and Enterprise plans.
Private repositories
The two scans above cover public code and public endpoints. Your own private code is a separate capability, and there are two ways to reach it. They share an engine and report format; coverage and limits differ.
| Route | How it works | Where your code goes |
|---|---|---|
| Managed, linked account Team and Enterprise |
Link GitHub, GitLab or Bitbucket, choose repositories from a list, scan them here. Reports are kept on your account for the length of your plan. | The archive is fetched and scanned on our infrastructure. |
| Self-hosted runner 1 free repository scan, then a plan |
Run the scanner inside your own network. It also reads built artifacts and container images, which the hosted scanner cannot. | Nothing leaves. Only findings are uploaded, and only if you ask. |
Signed out. Sign in to link GitHub, GitLab or Bitbucket and scan the private repositories you choose.
Want the internal picture too?
Repository scanning covers your code. The rest of your estate lives in certificates, key stores, TLS configuration, hardware modules and third-party services. A paid discovery engagement covers those, with human review of every material finding.
We use your email only to respond. See our privacy notice.