Quantum-readiness inventory

Build your cryptographic inventory before PQC migration.

VAJRA RECON builds a cryptographic inventory from source code and lockfiles you provide (zip export), mapping MD5, SHA-1, weak TLS, RSA references, and more. Findings require engineering validation; this is not a full HSM, network, or regulatory sign-off.

Honest scope: static analysis only. No live GitHub/AWS connector on this page. CI/CD webhooks and admin assessment are available for enterprise deployments.

Request inventory briefing API docs Sample output

What you receive (enterprise pilot)

  • ✓ Engineer report pack (JSON, Markdown, HTML)
  • ✓ SARIF for CI + PDF after triage session
  • ✓ RBI / NIST mapping on validated findings only
  • ✓ PQC migration path (VajraShield stack)

Executive summary is drafted after your engineer validates findings — not from raw scanner grades.

For banks & fintech

  • You export the zip — we do not clone your GitHub or hold standing repo access.
  • NDA + secure transfer before any source is shared.
  • India-hosted assessment infrastructure; on-prem path available.
  • Complements VAPT — crypto inventory for PQC planning, not a penetration test or regulatory sign-off.
  • API docs — CBOM API reference for platform engineers (pre-flight, upload, CI).

Sample output

What the pilot delivers

We keep the public page honest and concrete: raw engineer pack, validated executive pack, and exactly what is out of scope for a source-zip pilot.

Raw engineer pack
CBOM_REPORT.pdf — all pattern matches. For platform engineers and SARIF triage. Not for “we found X vulnerabilities.”
Validated executive pack
EXECUTIVE_VALIDATED_REPORT.pdf — TP only after your validator marks the triage sheet. Use this in steering and RBI/NIST mapping claims.
Out of scope
Network TLS assessment, HSM/KMS inventory, and live secrets need separate engagements — not inferred from a source zip alone.
flowchart TB
    S[Scope + NDA] --> Z[Export zip]
    Z --> P[Pre-flight check]
    P --> U[Upload or CI scan]
    U --> R[Engineer pack]
    R --> T[60-min triage]
    T --> V[Validated readout]
    V --> M[PQC migration plan]

API path: pre-flight → tenant upload → bundle download — CBOM API reference · Printable overview: CBOM one-pager (PDF) · Internal runbook mirrors CLIENT_CBOM_ONBOARDING + TRIAGE_RUNBOOK

Request enterprise briefing

Full report bundle + PQC migration path on VajraShield. We respond to verified corporate email.

Three-step summary

Same journey as the process map above — export, static scan, validate, then executive readout.

1. Export zip

Client exports repository source + lockfiles. Exclude .env, keys, node_modules, and secrets.

2. Static CBOM scan

Pattern + dependency audit with false-positive policy. Optional AST/taint when tree-sitter is available in the deployment image.

3. Validate + report

Triage session with your engineer (TP/FP/DEFER). Executive PDF and compliance mapping use validated items only — see process map.