CRYPTAGION — Post-Quantum Security
CI/CD integration

Stop quantum-vulnerable cryptography at the pull request.

Run cryptographic discovery on every change, produce a CycloneDX 1.6 CBOM, and fail the build when broken or quantum-vulnerable cryptography is introduced. Like an SBOM/vulnerability gate — but for cryptography.

Book a discovery call → Deployment & data flow
Your source code never leaves the runner — discovery executes in-pipeline.

The pipeline — four steps

  1. Discover — scan code, certificates and TLS for cryptography.
  2. CBOM — export a schema-valid CycloneDX 1.6 Crypto-BOM (artifact).
  3. Score — quantum-risk + harvest-now-decrypt-later per asset.
  4. Gate — fail the build when findings breach your policy.

GitHub Actions

# .github/workflows/crypto-inventory.yml
- name: Discover cryptography
  run: cryptagion scan code --path . --languages python,java,go,javascript,c --reset --exclude-tests
- name: Generate CycloneDX 1.6 CBOM
  run: cryptagion export cbom --output cbom.json
- name: Quantum-risk scoring
  run: cryptagion risk score -c confidential -y 10 --output assessments.json
- name: Upload CBOM + assessment        # audit trail for GRC
  uses: actions/upload-artifact@v4
  with: { path: "cbom.json\nassessments.json" }
- name: Crypto policy gate            # + SARIF for the Security tab
  run: cryptagion gate -c confidential -y 10 --max-critical 0 --max-high 10 --sarif crypto.sarif
- name: Upload SARIF to code scanning
  uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: crypto.sarif, category: cryptagion }

GitLab CI works the same way. Full examples and the policy options ship with the product.

What a blocked merge looks like

CRYPTAGION crypto gate — 43 cryptographic asset(s)
  critical: 15 · high: 15 · medium: 5 · low: 8
  worst score: 100/100
::error::15 critical finding(s) exceed policy (max-critical=0)
❌ Crypto policy gate FAILED.  → exit 1 → pull request blocked

The ::error:: line renders as a red annotation directly in the pull request. With --sarif, every finding also lands in GitHub's Security tab as a code-scanning alert — exact file and line, severity badge, dismissal workflow. No dashboard to build.

Two ways to integrate

Roll it out safely

Start the gate in report-only mode (a high threshold), baseline your estate, then tighten the policy wave by wave — so you never block a build on day one.

Want this on your pipeline? We'll wire CRYPTAGION into one repo's CI in the call — no payment until you've seen it gate a real change.

Book a free discovery call →

← Deployment · Home