Skip to main content
A project’s Cryptography page answers three questions in order: what cryptography the project ships, how much of it your code actually reaches, and what policy says about the part it reaches. It answers “which cryptography does this project use, and what does it put at risk?” without opening findings one by one. To open it, select a project, then Cryptography in the sidebar. It’s there only when your organisation has cryptography scanning, and every role that can read the project can open it. It was called Algorithms before; links to the old page still work and open the Assets tab with the same filters. The page lists the cryptography in the project’s current findings, so an asset you remove from the code drops off after the next scan. Under the title, the page names the scan its counts come from. Export makes a new CBOM of that scan. The page has three tabs: Overview, Libraries, and Assets. The tab is in the address, so a link opens the same view.

​
Overview

Overview opens on a funnel. The line above it counts the occurrences and the libraries they sit in. The funnel starts from the distinct assets they collapse to: one algorithm used at 500 call sites is one asset, the same count the Dashboard and the CBOM use. The steps then narrow that number: Each step is a link. The first three open the Assets tab filtered to what they count. Blocking a policy scrolls to Needs attention, which lists them. When Earnie traced no call path at all, the funnel stops at distinct assets and says reachability wasn’t analysed, rather than showing every later step as zero.

​
Where Reached Crypto Comes From

Beside the funnel, Where reached crypto comes from splits the reached assets by where their reachable findings live:
  • Your code.
  • Direct dependency. A library your project declares.
  • Transitive dependency. A library that arrives through another library.
  • A dependency whose relationship the scanner didn’t resolve.
Assets whose reachability is unknown are shown hatched, apart from the rest. An asset reached from two places counts under both, and the panel says so.

​
Needs Attention

Needs attention lists every open, reached finding that a policy attached to the project blocks, asks approval for, or warns about, with its strongest verdict. Each row shows:
  • the asset, and the library it lives in (or your code);
  • the route from your entry point to the cryptographic call, with the libraries it crosses in call order;
  • the policy and its verdict (Block, Require approval, or Warn);
  • the post-quantum status.
These are the same verdicts the pull request gate and MCP give. A finding you’ve decided leaves the list, whatever a policy says of it. Select the asset to open that finding in Review. Under the table, three tiles open presets of the Assets tab: how many assets are quantum-vulnerable and how many of those are reached, how many carry a key size, and how many certificates and pieces of key material the project holds.

​
Libraries

Libraries has one row per library that ships cryptography, and one for your own code.
  • How it gets in says whether your project declares the library or it arrives through another one. For a transitive library it also shows the chain of declarations that brings it in, with its depth.
  • The other columns count occurrences, assets, and how many of those assets are reached, and sum what policy says: for example 1 blocked, 1 needs approval, 3 warned, Inventory only for a library nothing reaches, or No policy verdict.
  • The Occurrences column is left out when it equals Assets on every row.
Select a row to split that library’s assets into reached, not reached, and undecided, three counts that sum to its assets, and to list the reached ones. Review’s Components view links here with View in Cryptography.

​
Assets

Assets lists every asset type: algorithms, protocols, certificates, and key material. Above the table, four presets choose what it lists: A preset leaves out a column no row fills, such as Key size on certificates. Choosing a preset clears the filters, and the search, filters, and sort then work within it. The preset is in the address. In All assets, spellings that differ only in capitalisation or surrounding spaces, such as aes-256-gcm and AES-256-GCM, are one row, so a row can hold more than one asset. Every count on the tab is of assets, never of rows, and agrees with the Overview. Two counts sit above the table: High or critical (assets with an open finding of that severity) and Only in dependencies. Each one opens the table filtered to what it counts. Under them, two charts split the same assets:
  • Post-quantum status: Vulnerable, Safe, Not applicable, and Not assessed.
  • Severity: from Critical to Info. An asset whose findings are all decided has no severity, so the chart leaves it out and says how many assets it covers.
Each name under a chart is a link that opens the table filtered to it, keeping the other filters you’ve set, and the one in force is marked. A status or severity that no asset has is left out.

​
What Each Column Shows

​
What Counts as Open

A finding leaves Open findings and Severity only when it no longer counts towards the gate: when it’s suppressed, or closed by a correction saved to Scan Configuration. The same rule decides the merge gate, so this page and the gate always agree. For the crypto decisions:
  • False positive and Accepted risk remove a finding from the gate, so it’s no longer open.
  • Confirm usage keeps a finding in the gate, so it stays open.
Counts ignore decisions, so deciding a finding never makes an asset disappear from this page. See the cryptography decisions in Triaging findings.

​
Opening an Asset

Select an asset to see its details beside the table, or in a panel from the right on a narrower screen:
  • Quantum readiness says whether a quantum computer could break it.
  • Where it is used counts files in your code, findings inside dependencies, and assets, and names the libraries that implement it.
  • Open in Review opens Review, filtered to that asset, with the first file that implements it open. For an asset that appears only inside dependencies, it opens Review’s Components view, filtered to the packages that contain it.

​
Searching and Filtering

  • Search matches names, families, primitives, and libraries.
  • The filters narrow by asset type, primitive, quantum status, severity, policy verdict, and where it’s used.
  • A link from the funnel, a tile, or the Dashboard can also narrow the list in ways the filter bar has no control for. Each one shows as a chip under the filters: High or critical, Weak or quantum-vulnerable, Reached by your code, and Reachable, still open. Select a chip to drop it.
The address holds the filters, the sort, and the selected asset. Switching tabs drops them. When the filters leave nothing to show, the page names the ones that are on, and Clear filters brings every row back.

​
When the Page Is Empty

  • This organization does not run cryptography detection: cryptography scanning isn’t enabled for your organisation. The sidebar has no Cryptography entry then, so you see this only from a direct link.
  • No cryptographic assets in this project: no scan with cryptography enabled has found an asset in this project yet.
  • Couldn’t load the cryptography: Earnie couldn’t fetch the data. Select Retry.

​
What’s Next

For the project’s cryptography across scans, see the Cryptography tab on the Dashboard. To decide individual crypto findings, see Triaging findings.