QuantumGenie CipherScan

QuantumGenie CipherScan is a free, offline Visual Studio Code extension for finding insecure cryptography, building a source-code cryptographic inventory, and discovering post-quantum cryptography signals.

Everything runs inside VS Code. Source code, filenames, findings, and repository metadata are not uploaded. v0.1.0 requires no account and contains no telemetry, analytics, AI, billing, or backend integration.

What CipherScan shows

CipherScan keeps three different kinds of results separate:

• Vulnerabilities identify insecure or unsafe usage such as MD5, SHA-1, legacy ciphers, AES-ECB, weak RSA keys, disabled certificate validation, obsolete TLS, static IVs, likely embedded key material, and insecure randomness in security-sensitive contexts.
• Cryptographic Inventory identifies algorithms and systems that may be valid but should be known and managed, including public-key cryptography, AES modes, ChaCha20-Poly1305, TLS, certificates, JWT signing, KMS usage, and cryptographic dependencies.
• PQC & Hybrid Signals identify ML-KEM, ML-DSA, SLH-DSA, Kyber, Dilithium, SPHINCS+, PQC dependencies, and explicit hybrid classical/post-quantum configurations.

Vulnerabilities appear in the editor and Problems panel. All categories appear in the CipherScan Activity Bar view.

Supported files

Fully tested:

• JavaScript and JSX
• TypeScript and TSX
• Python

Preview coverage:

• Java
• Go
• C#

Dependency inventory supports common npm, Python, Maven, Gradle, Go, and .NET manifests. Preview means the included rule-fixture matrix passes, but wider real-world feedback is still being collected.

Getting started

1. Open a project in VS Code.
2. Select the QuantumGenie icon in the Activity Bar.
3. Run QuantumGenie CipherScan: Scan Workspace.
4. Open any result to navigate to its exact source range.
5. Hover over a diagnostic or use its Quick Fix menu for an explanation, suppression, rule control, severity control, or an external standards reference.

Open the Command Palette to use:

• QuantumGenie CipherScan: Scan Active File
• QuantumGenie CipherScan: Scan Workspace
• QuantumGenie CipherScan: Cancel Scan
• QuantumGenie CipherScan: Clear Findings
• QuantumGenie CipherScan: Export Findings
• QuantumGenie CipherScan: Show Scan Summary
• QuantumGenie CipherScan: Open Settings

Workspace scans display native progress, scanned-file and finding counts, and a cancellation control. Multi-root, remote, restricted, and virtual workspaces are supported through VS Code's workspace filesystem API. CipherScan reads text files but never executes workspace code.

Scanning and exclusions

CipherScan skips common dependency, build, generated, binary, lock, and minified content by default, including:

.git, node_modules, vendor, dist, build, out, coverage, .next,
target, bin, obj, *.min.js, lockfiles

The root .gitignore in every workspace folder is respected by default. Add workspace-relative globs to quantumgenie.excludePatterns for project-specific exclusions.

Example:

{
  "quantumgenie.excludePatterns": [
    "legacy/generated/**",
    "**/snapshots/**"
  ]
}

Use quantumgenie.suppressedPaths when findings should remain visible in the Suppressed Findings group rather than being skipped entirely.

Suppressing a finding

Use the finding's Quick Fix action, or add a directive immediately above the affected line:

// quantumgenie-ignore weak-hash-md5
const digest = crypto.createHash("md5").update(payload);

Python uses #:

# quantumgenie-ignore weak-hash-md5
digest = hashlib.md5(payload).hexdigest()

The directive applies only to the named rule on the following line. quantumgenie-ignore all suppresses all CipherScan rules on the following line. Suppressed results remain reviewable in the Activity Bar. The Quick Fix can optionally store an accepted-risk reason in local VS Code workspace state; it is not uploaded or included in source code.

Individual rules can be disabled with quantumgenie.disabledRules. Workspace-specific severities can be assigned with quantumgenie.severityOverrides.

Settings

Rule catalogue

Vulnerability rules

weak-hash-md5, weak-hash-sha1, weak-legacy-cipher, aes-ecb-mode, weak-rsa-key-size, deprecated-crypto-api, disabled-tls-validation, obsolete-tls-version, static-initialization-vector, hardcoded-key-material, security-sensitive-insecure-randomness

Inventory rules

inventory-classical-public-key, inventory-elliptic-curve, inventory-modern-symmetric, inventory-tls-certificates, inventory-jwt-signing, inventory-key-management, inventory-crypto-dependency

PQC and hybrid rules

pqc-ml-kem, pqc-ml-dsa, pqc-slh-dsa, pqc-legacy-algorithm-name, pqc-dependency, pqc-hybrid-configuration

Every finding includes a stable rule ID and version, category, severity, confidence, algorithm, source range, safe evidence label, explanation, impact, recommendation, and primary reference.

Local reports

Export Findings creates either:

• JSON containing the normalized CipherScan finding model, summary, extension version, rule-set version, timestamp, and scan scope.
• SARIF 2.1.0 containing active results, rule metadata, locations, and stable partial fingerprints for compatible security tools.

Exports use workspace-relative paths and safe evidence labels. They do not contain source lines, matched source literals, or complete suspected secret values. The JSON format is designed to support future CBOM interoperability, but v0.1.0 is not a complete CBOM implementation.

Privacy and security

CipherScan v0.1.0:

• scans locally and works offline;
• makes no telemetry, analytics, AI, account, billing, or backend requests;
• does not execute project code;
• does not display or export full suspected secret values;
• writes a report, source suppression, or workspace setting only after an explicit user action.

See PRIVACY.md and SECURITY.md.

Limitations

CipherScan is contextual static pattern analysis, not whole-program data-flow analysis. A finding is a prompt for engineering review, not proof of exploitability or compliance. Dynamic algorithm construction, wrappers, generated code, and cryptography implemented without recognizable APIs may not be detected. No scanner can guarantee that software is secure, complete, or compliant.

License and support

CipherScan is free to use under the included proprietary license. See LICENSE.txt.

For help and reproducible defects, see SUPPORT.md or use the repository issue tracker.