quantumscan-io/scanner-core

Top findings

• CriticalCWE-328MD5

  .github/ISSUE_TEMPLATE/suggest_pattern.yml:28

  SHA3-256 or SHA-256

  Raw evidence

  - Weak hash/cipher (MD5/SHA-1/DES/RC4) — classically weak

• HighCWE-327ECDSA

  .github/ISSUE_TEMPLATE/false_positive.yml:16

  ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)

  Raw evidence

  placeholder: ecdsa-keygen

• HighCWE-327DSA

  .github/ISSUE_TEMPLATE/suggest_pattern.yml:11

  ML-DSA (CRYSTALS-Dilithium)

  Raw evidence

  like ML-KEM/Kyber/Dilithium/Falcon/SLH-DSA).

• Highliboqs (Open Quantum Safe) — entropy audit required

  .github/ISSUE_TEMPLATE/suggest_pattern.yml:17

  Mandate OQS_randombytes() for ALL key generation (it sources from OpenSSL's CSPRNG). Audit every call to OQS_KEM_*/OQS_SIG_* key generation and trace the entropy path. Never mix rand()/Math.random() in the same translation unit as liboqs keygen.

  Raw evidence

  placeholder: "e.g. Falcon-512 signature verification (liboqs binding)"

• HighCWE-327DSA

  .github/ISSUE_TEMPLATE/suggest_pattern.yml:26

  ML-DSA (CRYSTALS-Dilithium)

  Raw evidence

  - Classical asymmetric crypto (RSA/DSA/DH) — quantum-vulnerable

+ 57 more findings in the full report