nationwide-group-oss/cryptopticCodeQL-based scanner that inventories cryptographic function calls across repositories and GitHub organizations, producing a Cryptographic Bill of Materials (CBOM) in SARIF format.
Find the cryptography hiding in your code before quantum computers find it for you.
cryptoptic uses CodeQL and GitHub Actions to scan a repository or an entire GitHub organisation and produce an inventory of every cryptographic function in use, the library it comes from, and where it is called.
The anticipated arrival of cryptographically relevant quantum computing means that many algorithms in widespread use today will no longer keep data secure. "Harvest now, decrypt later" makes this a present-day risk, not a future one.
Before an organisation can migrate to post-quantum algorithms, it needs to understand where cryptography is used across its codebase. cryptoptic helps create that Cryptographic Bill of Materials (CBOM), so vulnerable algorithms can be replaced with quantum-safe alternatives or managed transparently.
cryptoptic was built and is used internally at Nationwide Building Society. It is released here for the wider community.
| Language | Status | TARGET_LANG value |
|---|---|---|
| Python | Supported | python |
| JavaScript | Supported | javascript |
| .NET | Supported | csharp |
| Java | Planned |
Clone this repository and open it in an editor of your choice.
Edit .github/workflows/org-codeql-sarif-run.yml and set the required workflow values.
| Setting | Description |
|---|---|
ORG | The organisation to scan. For a personal repository, use your GitHub username. |
REPO | The repository to scan. Leave as an empty string to scan every repository in the organisation. |
TARGET_LANG | The language to scan see Supported languages for valid values. |
Commit and push your changes.
Go to the Actions tab in GitHub and select CodeQL org run (crypto inventory) from the left-hand sidebar.
Click Run workflow, choose the branch you want to run against, and click the green Run workflow button.
The generated files are published as artifacts on the workflow run:
To work on cryptoptic itself, you will need:
Contributions are welcome, including code, queries, documentation, tests and bug reports. Please read the Code of Conduct before participating; it applies to every project space.
See GOVERNANCE.md for how decisions get made and MAINTAINERS.md for who to talk to.
Please do not report security vulnerabilities through public GitHub issues. See SECURITY.md for how to report privately and what to expect after you do.
This project is licensed under the Apache License, Version 2.0. A copy of the licence should be included in the repository in a file named LICENCE or LICENSE. Users should review the licence terms before using, modifying or distributing the project.
Where the project is redistributed, the Apache License 2.0 requires preservation of applicable copyright, patent, trade mark and attribution notices, inclusion of a copy of the licence, notices for modified files where applicable, and appropriate handling of any NOTICE file included with the project.
If the repository includes a NOTICE file, users and redistributors must preserve the attribution notices contained in that file in accordance with the Apache License 2.0. The NOTICE file should be kept accurate and should reflect the notices applicable to the contents of the distribution.
The Apache License 2.0 does not grant permission to use Nationwide's names, logos, trade marks or branding. Any use of Nationwide branding or project-specific branding must comply with the project's separate trade mark policy.
As described in the Apache License 2.0, the project is provided on an "AS IS" basis, without warranties or conditions of any kind. Users are responsible for determining whether the project is appropriate for their use and for validating any outputs before relying on them.
