Read this first
- A detection is not a vulnerability. Imports, curve identifiers, lookup tables and capability checks all count as detections. Nothing here measures deployed exposure or business impact.
- Python files only. All 243 tracked Python files were scanned with no skips or failures. The 109 Rust files, 33 Python stub files, other languages, dependencies and runtime behaviour were not. This is not a whole-repository or detection-recall claim.
- Tests dominate. 1,746 of the 1,804 detections are in tests. Only 46 are in library source, and we reviewed all 46 by hand. That is why the explorer opens on library source.
- One known label error. A DSA test call at
tests/hazmat/primitives/test_dsa.py:113is reported as Diffie–Hellman. We kept it as-is so the record stays auditable; family labels in tests were not all checked. - Risk classes are a reading aid. The three colour classes are our display grouping. The scanner’s raw risk field mixes classical hash weaknesses (MD5, SHA-1) with quantum concerns, and its scores are not customer impact.
- No full dependency graph is included in the CBOM.
- Repeatable, not independently reproduced. The second run used the same machine and environment; normalised findings and scores matched.
Target: pyca/cryptography @ d45b7930f93c · scanned 10 October 2026 · independent demonstration, no endorsement by pyca implied.
- Case study and method
- Raw CBOM (CycloneDX 1.6, 1.5 MB)
- Library review ledger (CSV)
- Validation results
- Book a demo
Explore the detections
Where these numbers come from
The explorer loads one compact file, explorer.json, generated from the published cbom.json and library-review.csv without changing them. The generator recomputes the total, the scope split and every family count, and refuses to write the file unless they equal validation.json. Algorithm names, paths, lines and symbols are shown exactly as the scanner recorded them; the review notes are the manual interpretations from the ledger.
Want this view for your own code? We run the same discovery on a repository that matches your stack and walk you through the evidence.
Book a demo →← Home · Resources · CBOM generator · Cryptographic inventory