QuantumLedger-CBOM

QuantumLedger-CBOM is a Flask-based CBOM scanner for web application projects. It inventories cryptography-related components, highlights post-quantum exposure, generates a structured Cryptographic Bill of Materials (CBOM), and produces reports, exports, and optional AI-assisted summaries from the saved scan result.

Built with ❤️ to make CBOM analysis and post-quantum security thinking easier, clearer, and more accessible.

In this repository, "CBOM" means a practical inventory of cryptography-relevant findings such as TLS endpoints, certificates, SSH keys, JWT signing, database transport encryption, crypto libraries, backup encryption, and infrastructure context. The generated CBOM is an application-specific inventory table with migration metadata, not a CycloneDX-style standardized SBOM extension.

The actual application code lives in the nested QuantumLedger-CBOM/ directory. The top-level repository exists mainly as the GitHub root.

Quick Start

From the repository root:

cd .\QuantumLedger-CBOM
python -m venv .venv
.venv\Scripts\Activate.ps1
pip install -r requirements.txt
Copy-Item .env.example .env
python run.py

Then open:

http://127.0.0.1:5000

Notes:

The Copy-Item .env.example .env step is only required if you want to enable the optional Groq-backed AI features.
The Flask app starts from QuantumLedger-CBOM/run.py with debug=True.
Scan outputs are written under QuantumLedger-CBOM/exports/scans/.

What Problem This Project Solves

Modern web applications often use cryptography in many places at once:

TLS termination at the edge
X.509 certificates and private keys
SSH host and deploy keys
JWT or token signing
database TLS
KMS or secret-management integrations
backup encryption
crypto libraries hidden inside source code or dependency manifests

That makes post-quantum planning hard: teams need to know which findings are public-key dependent, which findings can stay symmetric, and which changes should happen first.

QuantumLedger-CBOM addresses that by:

scanning a repository or ZIP archive, or accepting analyst-supplied manual context
classifying findings into a consistent CBOM structure
assigning risk, quantum exposure, migration notes, downtime/hardware impact, and QKD candidacy
generating downloadable HTML, JSON, CSV, and Markdown artifacts
optionally sending the saved scan facts to Groq for management-friendly AI summaries and migration advice

Features

Implemented in the current codebase:

Manual Input mode for analyst-led inventory of external TLS, SSH, database, KMS/HSM, and third-party crypto context
Auto Scan mode for local repositories, uploaded ZIP archives, and Git repository URLs
Optional hybrid workflow where Manual Input mode can also scan a local path, ZIP, or Git repository and merge manual findings into the result
File discovery across source, scripts, manifests, config, proxy, container, Kubernetes, certificate, CI, and SSH assets
Code-pattern detection for RSA, ECC, JWT signing, AES, ChaCha20, SHA-2, SHA-3, HMAC, OpenSSL CLI usage, KMS references, and SSH libraries/commands
Certificate and private-key parsing for .crt, .cer, .pem, .key, .p12, and .pfx
TLS and HTTPS detection from config files plus optional live endpoint inspection for a provided domain or endpoint
SSH config analysis from sshd_config and ssh_config
Database transport, at-rest encryption, and backup-encryption detection from config and scripts
Dependency analysis from requirements.txt, pyproject.toml, and package.json
CBOM generation with per-finding IDs, quantum exposure, migration guidance, downtime/hardware flags, and QKD candidacy
Tiered migration planning with Tier 1, Tier 2, and Tier 3 actions
Web GUI with dashboard, CBOM viewer, migration plan view, HTML report view, and export download page
Export generation in HTML, JSON, CSV, and Markdown
Optional Groq-backed AI Executive Summary, AI Migration Plan, and AI QKD Decision helper
Included demo scan target under QuantumLedger-CBOM/sample_projects/flask_demo_target/
Automated tests for the scanner, reporting, AI routes/service behavior, and documentation expectations

Workflow Overview

The implemented UI flow is:

Open the home page at /.
Start a new scan from /scans/new.
Choose either Manual Input mode or Auto Scan mode.
Submit scan inputs.
Wait for the scan to finish synchronously.
Review the results in the Findings Dashboard.
Open the CBOM Viewer, Migration Plan, HTML Report, or Exports tab.
If Groq is configured, generate AI outputs from the saved scan result.

Main screens currently present in the app:

Screen	Route	What it does
Home	`/`	Landing page plus recent scans list
New Scan	`/scans/new`	Lets the user choose Manual vs Auto
Manual Input	`/scans/new/manual`	Analyst-led form with optional repo/ZIP/Git source
Auto Scan	`/scans/new/auto`	Repository-driven scan wizard
Findings Dashboard	`/scans/<scan_id>/dashboard`	Summary cards, AI panel, metadata, priority findings
CBOM Viewer	`/scans/<scan_id>/cbom`	Full filterable CBOM table
Migration Plan	`/scans/<scan_id>/migration`	Tiered migration roadmap and QKD section
HTML Report	`/scans/<scan_id>/report`	Embedded standalone report with download/new-tab options
Exports	`/scans/<scan_id>/exports`	Download links for saved artifacts

Additional routes:

/downloads/<scan_id>/<fmt> downloads an export file.
/reports/<scan_id>/html returns the standalone HTML report body.
/ai/summary/<scan_id>, /ai/migration-plan/<scan_id>, and /ai/qkd-decision/<scan_id> accept POST requests and persist AI outputs.

No screenshots are committed in the repository right now. If you want to add them later, the most useful places are:

Home page
New Scan choice page
Findings Dashboard
CBOM Viewer
Export page

How It Works Internally

The current scan pipeline is implemented as follows:

RepoLoader prepares a per-scan workspace under exports/scans/<scan_id>/.
Depending on the request, it either:
- scans a local path in place
- extracts an uploaded ZIP into the workspace
- clones a Git repository into the workspace with git clone --depth 1
- or runs as manual-only if no repository source is provided
FileDiscovery walks the scan root, categorizes relevant files, and applies scan-depth limits.
Specialized analyzers inspect the discovered assets:
- CertificateAnalyzer
- TLSAnalyzer
- SSHAnalyzer
- DBCryptoAnalyzer
- DependencyAnalyzer
- CodeCryptoDetector
Manual findings from the submitted form are converted into the same Finding structure.
CBOMBuilder deduplicates findings, sorts them by severity, and assigns IDs like CBOM-0001.
MigrationPlanner creates a tiered PQ migration plan plus a deterministic QKD section.
Exporters write HTML, JSON, CSV, and Markdown files.
The full structured result is saved as scan_result.json.
If AI is enabled later, the AI layer reads the saved result, writes AI artifacts, and refreshes the HTML/JSON/Markdown reports.

Important implementation details:

Upload size limit: 50 MB
Scan-depth file limits:
- quick: 250 files
- normal: 1000 files
- deep: 5000 files
Text parsing skips binary files and files larger than 1,500,000 bytes
Local-path scans do not copy the target repo into the workspace; they scan the path in place
ZIP uploads are extracted into the scan workspace
Git URL scans require Git to be installed and available on the host PATH
If a Git clone fails or the local path does not exist, the scan can still proceed with manual inputs and notes

Scan Coverage and Detection Scope

The current implementation covers the following crypto-relevant surfaces.

Certificates and Keys

Parsed by QuantumLedger-CBOM/scanner/cert_analyzer.py:

.crt, .cer
.pem
.key
.p12
.pfx

The analyzer identifies public-key type and related details for:

RSA
ECC
Ed25519
Ed448
DSA

If a private key or PKCS#12 archive requires a password, the tool records that the asset exists even when deep parsing is incomplete.

TLS, HTTPS, and Edge Configuration

Detected by QuantumLedger-CBOM/scanner/tls_analyzer.py:

reverse-proxy and config files containing TLS directives
Kubernetes ingress/manifests with TLS sections
config references such as ssl_certificate, ssl_certificate_key, HTTPS endpoints, and TLS versions
database TLS hints found in config files such as sslmode=require, ssl=true, or tls=true
optional live endpoint inspection for the primary domain and any extra TLS endpoints entered in the form

If live inspection succeeds, the tool records:

observed TLS version
observed cipher
peer certificate details

If live inspection fails, the scan records a finding explaining that the inspection could not complete instead of crashing the scan.

SSH

Detected by QuantumLedger-CBOM/scanner/ssh_analyzer.py:

sshd_config
ssh_config
HostKey
IdentityFile
HostKeyAlgorithms
PubkeyAcceptedAlgorithms

Algorithms explicitly recognized from text:

RSA
ECDSA / ECC
Ed25519

Manual SSH usage can also be recorded even when no SSH config file exists in the scanned project.

Database Crypto and Backup Encryption

Detected by QuantumLedger-CBOM/scanner/db_crypto_analyzer.py:

DB TLS and SSL parameters:
- sslmode=require
- ssl=true
- tls=true
- sslrootcert
- sslcert
- sslkey
- rediss://
at-rest database encryption hints:
- transparent data encryption
- tde
- storage_encrypted
- encrypted=true
backup encryption hints:
- backup ... openssl ... aes
- gpg --cipher-algo

Source-Code and Script Pattern Detection

Detected by QuantumLedger-CBOM/scanner/code_crypto_detector.py using the patterns in QuantumLedger-CBOM/detectors/patterns.py:

JWT signing patterns:
- RS256, RS384, RS512
- PS256, PS384, PS512
- ES256, ES384, ES512
RSA key generation or key handling
ECC or EC-family key generation or key handling
AES
ChaCha20 / ChaCha20-Poly1305
SHA-2
SHA-3
HMAC
OpenSSL CLI operations
KMS or secret-manager references
SSH libraries and SSH command usage

Dependency Manifest Analysis

Detected by QuantumLedger-CBOM/scanner/dependency_analyzer.py:

requirements.txt
pyproject.toml
package.json

The built-in dependency map currently recognizes crypto-relevant packages such as:

cryptography
pyjwt
paramiko
pyopenssl
jwcrypto
boto3
google-cloud-kms
azure-keyvault-secrets
azure-keyvault-certificates
hvac
psycopg2
psycopg
mysqlclient

File and Asset Discovery

Relevant assets are identified by QuantumLedger-CBOM/scanner/file_discovery.py. It categorizes files such as:

source files: .py, .js, .ts, .tsx, .jsx, .java, .go, .rs
scripts: .sh, .ps1
certificates: .crt, .cer, .pem, .key, .p12, .pfx
config and env files: .env, .toml, .json, .ini, .cfg, .conf, .yaml, .yml, .tf
special filenames like:
- Dockerfile
- docker-compose.yml
- compose.yaml
- nginx.conf
- apache.conf
- httpd.conf
- Caddyfile
- sshd_config
- ssh_config
- requirements.txt
- pyproject.toml
- package.json

What the CBOM Contains

Each finding in the generated CBOM includes fields such as:

component ID
component name
layer
asset type
file path or endpoint location
crypto function
algorithm
RSA/ECC/symmetric flags
key or certificate details
protocol
purpose
risk level
quantum exposure
recommended migration
downtime requirement
hardware-change requirement
QKD candidacy
notes

Risk, exposure, and migration guidance are inferred by QuantumLedger-CBOM/analyzers/posture.py.

That posture logic intentionally treats:

public-key findings as the main PQ migration concern
symmetric/hash/MAC findings as generally retainable with parameter review
QKD as a special-case physical-link option rather than a default application recommendation

Report and Export Outputs

Every scan creates a workspace under:

QuantumLedger-CBOM/exports/scans/<scan_id>/

Important saved files:

Path	What it contains
`exports/scans/<scan_id>/scan_result.json`	Full saved scan result, including request, source context, discovered assets, CBOM, migration plan, exports, and later AI outputs
`exports/scans/<scan_id>/artifacts/cbom_report.html`	Standalone HTML report
`exports/scans/<scan_id>/artifacts/cbom_report.json`	Exported JSON report
`exports/scans/<scan_id>/artifacts/cbom_inventory.csv`	Flat CBOM inventory table
`exports/scans/<scan_id>/artifacts/cbom_report.md`	Markdown report

If AI output is generated, the following files are also created in the scan workspace root:

Path	What it contains
`exports/scans/<scan_id>/ai_summary.json`	Saved AI executive summary payload
`exports/scans/<scan_id>/ai_summary.md`	Markdown rendering of the AI summary
`exports/scans/<scan_id>/ai_migration_plan.json`	Saved AI migration-plan payload
`exports/scans/<scan_id>/ai_migration_plan.md`	Markdown rendering of the AI migration plan
`exports/scans/<scan_id>/ai_qkd_decision.json`	Saved AI QKD decision payload
`exports/scans/<scan_id>/ai_qkd_decision.md`	Markdown rendering of the AI QKD decision

How exports work in the GUI:

The report formats are chosen during scan creation.
The Findings Dashboard links to the other result tabs.
The HTML Report page embeds the standalone report in an iframe.
The Exports page exposes download buttons for the selected artifact types.
When AI output is saved, the JSON, Markdown, and HTML report exports are refreshed so they include the new AI sections.

What the HTML report includes:

scan metadata
severity and quantum-exposure summaries
a discovered-assets table
the CBOM inventory
RSA/ECC highlights
dependency notes
TLS section
SSH section
database section
deterministic tiered migration roadmap
AI analysis section if AI output exists
deterministic QKD section

The repository does not ship pre-generated sample outputs. The exports/ and uploads/ folders are intentionally kept empty except for .gitkeep placeholders.

Web GUI Usage

Starting a New Scan

From the GUI:

Open New Scan.
Choose Manual Input Mode or Auto Scan Mode.
Enter the project name.
Choose one source option if needed:
- local repository path
- Git repository URL
- ZIP upload
Pick a scan depth.
Select output formats.
Submit the scan.

Manual Input Mode

Manual Input mode is the best fit when key crypto facts live outside the repository. The form supports:

repository path, Git URL, or ZIP upload
primary domain and extra TLS endpoints
SSH usage and SSH details
database type and encryption details
KMS/HSM/secrets-manager presence and details
infrastructure info
deployment details
external config references
manual TLS notes
manual DB notes
third-party API crypto notes
custom notes
unlimited add/remove manual finding rows in the browser

If you provide both manual information and a repository source, the tool merges both into a single CBOM.

Auto Scan Mode

Auto Scan mode is the repository-driven workflow. It supports:

local repository path
Git repository URL
ZIP archive upload
primary domain / TLS endpoint for optional live handshake inspection
extra infrastructure hints that help classify findings more accurately

Reviewing Results

After submission, the app redirects to the Findings Dashboard. From there you can:

review high-level counts
inspect scan metadata and scan notes
open the full CBOM table
open the deterministic migration plan
open the standalone HTML report
download exports
run AI actions if GROQ_API_KEY is configured

Using the CBOM Viewer

The CBOM Viewer shows the full inventory in a table and includes a client-side text filter. You can search by:

component
algorithm
protocol
notes
location

Viewing Recent Scans

The home page lists up to 8 recent scan workspaces based on saved scan_result.json files.

Requirements

The repository does not pin a single Python version in code comments or packaging metadata, but it uses modern Python features and was successfully tested in this workspace with Python 3.13.0.

Practical requirements:

Python
pip
Git only if you want to use Git URL scan mode

Primary Python dependencies in QuantumLedger-CBOM/requirements.txt:

Flask>=3.1.0
cryptography>=44.0.0
openai>=1.30.0
pytest>=9.0.0

Dependency notes:

openai is only needed for the optional Groq AI features, but it is included in the default requirements file.
The current README commands use PowerShell because this repository was inspected in a Windows workspace. The app itself is not Windows-only.

Installation

From the repository root:

cd .\QuantumLedger-CBOM
python -m venv .venv
.venv\Scripts\Activate.ps1
pip install -r requirements.txt

If you want to enable AI features, create the project root .env file inside the nested app directory:

Copy-Item .env.example .env

That creates:

QuantumLedger-CBOM/.env

If you do not want AI yet, you can skip the .env file entirely and the scanner will still run.

Configuration

Configuration is loaded from:

QuantumLedger-CBOM/.env

The loader is implemented in QuantumLedger-CBOM/app/config.py.

`.env` Example

GROQ_API_KEY=your_groq_api_key_here
GROQ_MODEL=llama-3.1-8b-instant
AI_FEATURES_ENABLED=true
CBOM_SCANNER_SECRET=change-this-for-non-dev-use

What Each Setting Does

Variable	Required	Purpose	Notes
`GROQ_API_KEY`	Only for AI	Enables Groq-backed AI actions	If missing, deterministic scanning still works
`GROQ_MODEL`	Optional	Chooses the Groq model used by the AI routes	Defaults to `llama-3.1-8b-instant`
`AI_FEATURES_ENABLED`	Not actually authoritative	Present in `.env.example`	The app currently recomputes this flag from whether `GROQ_API_KEY` is present
`CBOM_SCANNER_SECRET`	Optional	Flask secret key	Defaults to `cbom-scanner-dev-secret` if not set

Other built-in config values currently hard-coded in the app:

upload folder: QuantumLedger-CBOM/uploads
export folder: QuantumLedger-CBOM/exports/scans
upload size limit: 50 MB
scan depth limits:
- quick: 250 files
- normal: 1000 files
- deep: 5000 files

Sample Project Configuration Example

The included demo target has its own example config file at:

QuantumLedger-CBOM/sample_projects/flask_demo_target/config/.env.example

That file belongs to the demo scan target, not to the scanner application itself.

Running the Application

From the nested app directory:

python run.py

Expected local URL:

http://127.0.0.1:5000

Before the first run:

install the requirements
optionally create QuantumLedger-CBOM/.env for AI
make sure any local repository path you plan to scan actually exists
make sure Git is installed if you plan to scan a remote Git URL

Because run.py calls app.run(debug=True), the current startup path is a development server, not a production deployment setup.

AI Features

AI is optional. The deterministic scanner remains the source of truth.

The AI layer is implemented in QuantumLedger-CBOM/app/ai_service.py and the dashboard integration is implemented in:

What the AI Does

After a scan completes, the app builds a structured payload from the saved scan result. That payload includes:

project and scan metadata
counts of:
- RSA findings
- ECC findings
- TLS findings
- SSH findings
- DB TLS findings
- backup encryption findings
risk totals
compact summaries of TLS, SSH, database, and backup findings
public-key versus symmetric exposure summaries
network-context hints derived from infrastructure and deployment notes

The AI then uses that structured payload to generate:

an executive summary for management
a staged migration plan
a QKD decision recommendation

What the AI Does Not Do

The AI layer does not:

scan raw project files directly
replace the deterministic scanner
invent new findings that were not present in the saved scan context
make automatic code changes
make QKD the default recommendation for normal web apps

The AI analyzes the structured scan facts, not the raw repository tree.

AI Actions Available in the Dashboard

Generate AI Summary

Creates a management-friendly executive summary from the saved CBOM result, including:

top risks
immediate actions
non-urgent items
closing recommendation

Generate AI Migration Plan

Creates an AI-written staged roadmap with:

Tier 1 actions
Tier 2 actions
Tier 3 actions
public-key priorities
symmetric keep notes
compatibility risks
operational risks
rollback notes

Generate QKD Decision

Creates an advisory answer to questions such as:

Does QKD make sense here?
Is PQC or hybrid enough?
Are there any special physical-link conditions that would justify QKD evaluation?

The implementation intentionally defaults toward qkd_not_needed unless the structured scan context suggests a highly sensitive dedicated point-to-point link.

QKD Guidance in This Project

The current deterministic and AI logic both reflect the same stance:

QKD is not recommended by default
standard web apps should usually stay on a PQC or hybrid migration path
QKD is treated as a niche physical-link control for special transport environments
AI QKD output is advisory only

How to Enable AI Features

The current AI backend is Groq, accessed through the OpenAI-compatible Python client and Groq's OpenAI-compatible base URL.

Step-by-Step Setup

Create or sign in to your Groq account at console.groq.com.
Open the Groq quickstart/docs if needed: Groq Quickstart.
Create an API key from the Groq console. The docs link out to the API-key creation flow, and the keys page is available at console.groq.com/keys.
In this repository, open:
```
QuantumLedger-CBOM/.env
```
If it does not exist yet, create it from:
```
QuantumLedger-CBOM/.env.example
```

Add your key and optional model:

GROQ_API_KEY=your_groq_api_key_here
GROQ_MODEL=llama-3.1-8b-instant

Restart the Flask app with:
```
python run.py
```

What Happens If the Key Is Missing

The codebase currently handles missing AI configuration in three places:

the Findings Dashboard disables the AI buttons
the UI shows a setup hint that points the user to .env and GROQ_API_KEY
the backend AI routes return a 503 JSON error containing setup_path, variable_name, and a hint message

That behavior is covered by the tests in QuantumLedger-CBOM/tests/test_ai_routes.py and QuantumLedger-CBOM/tests/test_ai_ui_and_docs.py.

How to Get the API Key Safely

For beginners:

Go to Groq Console.
Sign in or create an account.
Open the API keys page: console.groq.com/keys.
Create a new key.
Copy the key value.

Paste it into:

QuantumLedger-CBOM/.env

using:

GROQ_API_KEY=your_groq_api_key_here

Important safety notes:

never commit a real API key to GitHub
keep secrets in .env, not in source files
keep .env.example as a placeholder-only file
rotate the key in the Groq console if you accidentally expose it

Running Tests

From the nested app directory:

python -m pytest

What the current tests cover:

AI route behavior and persistence
AI service payload construction and malformed-response handling
missing-key UI guidance and documentation expectations
algorithm-family classification
CBOM generation and summary counts
certificate parsing
file discovery
migration planning
scan orchestrator integration
HTML report generation
TLS and database detection

Test behavior notes:

AI calls are mocked in the test suite
tests do not require a real Groq key
tests write temporary artifacts under .test-artifacts

Verified in this workspace:

python -m pytest passed with 18 tests on March 26, 2026

Sample Project / Demo Target

The repository includes a safe demo scan target at:

QuantumLedger-CBOM/sample_projects/flask_demo_target/

It exists to demonstrate the scanner, not to provide a full runnable application. The files currently included are:

app/app.py
requirements.txt
config/.env.example
config/nginx.conf
config/sshd_config
docker/docker-compose.yml
k8s/ingress.yaml
scripts/backup.sh

The demo target intentionally contains scan surfaces for:

RSA JWT signing
AES-GCM usage
PostgreSQL sslmode=require
placeholder KMS environment data
Nginx TLS config
SSH config
Docker metadata
Kubernetes ingress TLS
OpenSSL backup encryption

Can You Run the Demo Target?

Not as a complete web server from the repository as it stands.

The sample target does not include:

a Flask app factory
a run.py
a flask run entrypoint
an if __name__ == "__main__" launcher

So the supported use case is:

scan it with CBOM Scanner

If you want to experiment with it manually, you can still inspect or install its dependencies, but a full runnable demo service is not implemented.

How to Scan the Demo Target

Start QuantumLedger-CBOM with python run.py.
Open Auto Scan.
Set Local Repository Path to:
```
sample_projects/flask_demo_target
```
or use the absolute path on your machine.
Choose Deep for the most complete demo scan.
Submit the scan.
Open the Findings Dashboard, CBOM Viewer, Migration Plan, and Exports tabs.

Example Usage

Example 1: Run a Deterministic Scan on the Demo Target

cd .\QuantumLedger-CBOM
python run.py

Then in the browser:

Open /scans/new/auto
Use sample_projects/flask_demo_target as the local path
Choose deep
Keep all four export formats enabled
Submit the scan

Expected result:

a saved scan workspace under exports/scans/<scan_id>/
a populated dashboard
a CBOM table containing TLS, JWT/RSA, DB TLS, SSH, dependency, and backup-encryption findings

Example 2: Add AI Output After the Scan

Create QuantumLedger-CBOM/.env with your Groq key.
Restart the app.
Open an existing scan's Findings Dashboard.
Click:
- Generate AI Summary
- Generate AI Migration Plan
- Generate QKD Decision
Open the Exports page and inspect the new AI JSON/Markdown artifacts.

Project Structure

Repository-level structure:

.
├── LICENSE
├── README.md
└── QuantumLedger-CBOM/
    ├── .env.example
    ├── .gitignore
    ├── LICENSE
    ├── README.md
    ├── analyzers/
    ├── app/
    ├── detectors/
    ├── exports/
    ├── parsers/
    ├── reports/
    ├── sample_projects/
    ├── scanner/
    ├── static/
    ├── templates/
    ├── tests/
    ├── uploads/
    ├── pytest.ini
    ├── requirements.txt
    └── run.py

Important folders inside the app:

app/ Flask app factory, routes, configuration, request helpers, dataclasses, and AI service
scanner/ Main scan orchestration plus repo loading, file discovery, analyzers, CBOM building, and migration planning
analyzers/ Shared posture logic for risk, quantum exposure, downtime, hardware impact, and QKD candidacy
detectors/ Pattern specifications and dependency maps
parsers/ Safe file reading and binary detection helpers
reports/ HTML report generator and JSON/CSV/Markdown exporters
templates/ Jinja templates for the web UI and standalone report
static/ CSS and JavaScript for the UI
tests/ Automated test suite
sample_projects/flask_demo_target/ Included demo scan target
exports/scans/ Runtime scan workspaces
uploads/ Uploaded ZIP storage during scans

Support and Troubleshooting

For bugs, feature requests, or questions, the most natural support channel for this repository is GitHub Issues.

Common troubleshooting points based on the current implementation:

If AI buttons are disabled, check whether QuantumLedger-CBOM/.env contains a valid GROQ_API_KEY.
If a Git URL scan does not work, verify that Git is installed and available on PATH.
If a local-path scan produces only manual findings, verify that the supplied path exists.
If a scan misses a large file, remember that the parser skips files larger than 1.5 MB or binary content.
If a ZIP upload fails, verify that the uploaded archive is under the 50 MB Flask request limit.

Roadmap

The following are reasonable future improvements based on the current design, but they are not fully implemented yet:

broader language- and framework-specific crypto detection beyond the current regex/pattern approach
larger dependency intelligence coverage beyond the current hard-coded dependency map
asynchronous/background scan execution for long-running scans
richer diffing or comparison between multiple scans over time
packaged deployment options beyond the current development server
more advanced certificate/password handling for protected key stores

Contributing

If you want to contribute:

Fork the repository.
Create a focused feature or fix branch.
Make your changes inside the nested QuantumLedger-CBOM/ app directory.

Run the test suite:

cd .\QuantumLedger-CBOM
python -m pytest

Keep pull requests small and explain the user-facing or scanner-behavior impact clearly.
Update documentation when routes, configuration, exports, or AI behavior change.

Good contribution areas in the current codebase include:

new detectors and analyzers
additional manifest formats
improved export/reporting UX
more granular tests
documentation and onboarding improvements

Authors and Acknowledgments

Visible ownership information in the repository today:

the top-level MIT license credits BnHany in 2026
the nested application includes its own MIT license file credited to CBOM Scanner contributors

The repository also includes:

a demo scan target for testing and onboarding
a test suite that exercises both deterministic scanning and optional AI integration
AI-assisted iteration and documentation support as part of a "vibe coding" style workflow, while the repository code and deterministic scanner remain the authoritative source
a DeepWiki project page for repository exploration: deepwiki.com/BnHany/QuantumLedger-CBOM
a Medium article about building the project: Building QuantumLedger-CBOM Tool

No separate contributors file or maintainer contact file is currently present.

License

This repository includes an MIT License at the repository root:

LICENSE

There is also an MIT license file inside the nested application folder:

QuantumLedger-CBOM/LICENSE

Before public distribution, you may want to ensure those notices stay intentionally aligned.

Project Status

Current status: active prototype / under development

Why this is a fair description of the repository today:

the end-to-end scan workflow is implemented
the web GUI is implemented
exports and HTML reporting are implemented
optional AI features are implemented
automated tests are present and passing
the app still runs as a development Flask server and uses filesystem-based scan workspaces rather than a packaged production architecture

Name		Name	Last commit message	Last commit date
QuantumLedger-CBOM		QuantumLedger-CBOM
LICENSE		LICENSE
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation