Threat model, signed releases and SBOM, parser sandbox, secret-redaction corpus, vulnerable fixtures, CBOM conformance, and license review.
Accuracy and security model
Security begins by statingwhat a scan cannot prove.
Qubrisk can cause harm through false assurance, missed dependencies, exposed metadata, or an unavailable CI gate. Those are product requirements, not disclaimer footnotes.
Central boundary
Qubrisk inventories detected cryptographic use and manages migration evidence. It does not certify an implementation, prove runtime behavior from static evidence, or replace a cryptographer reviewing a novel protocol.
Control model
Boundaries that survive the sales page.
Local by default
Source, private keys, and secrets remain local. Upload is limited to fingerprints, paths, metadata, selected redacted evidence, dependency identifiers, policy results, and CBOM records.
Hostile-input boundary
Parsers do not execute a repository build by default. The scanner limits time and resources, avoids following unsafe paths, and separates dependency resolution from code execution.
Evidence, not assurance theater
Every finding retains a rule, location, confidence, directness, first/last seen, and limitations. “Not detected” is never displayed as “safe.”
Tenant-scoped control plane
Sessions and API keys are hashed. Business queries carry an organization boundary. Exports, members, integrations, and deletion require server-side authorization.
CI availability
The scanner evaluates an established baseline with a local rule bundle. Hosted unavailability does not force a legitimate build to wait for the control plane.
Attributable exceptions
A bypass records an owner, specific reason, expiry, policy version, and audit event. It never rewrites the underlying evidence.
Detection labels
Four levels keep uncertainty visible.
Confirmed
Direct syntax, configuration, artifact, or runtime evidence.
Probable
Dependency or data-flow evidence strongly implies use.
Possible
A component contains cryptography; reachability is unconfirmed.
Unknown
Evidence is insufficient. A human or runtime check is required.
Assurance gates
Claims advance only when evidence does.
Independent penetration test, disclosure process, incident response, backup restore exercise, published coverage, and false-positive/negative benchmark.
Dedicated security owner, SOC 2 program, annual penetration tests, private data-plane design review, and legal review of security claims.