QSafe: Quantum-Safe Code Scanner by IBM Bob

QSafe Scanner — find, score and fix quantum-vulnerable cryptography, built with IBM Bob THE PROBLEM Large quantum computers running Shor's algorithm will break RSA, ECC and Diffie-Hellman — the cryptography behind TLS, payments, logins and signed software. Attackers can already "harvest now, decrypt later": record encrypted data today and decrypt it once quantum computers arrive. NIST published its post-quantum standards in August 2024 (ML-KEM FIPS 203, ML-DSA FIPS 204, SLH-DSA FIPS 205), and its draft transition plan (NIST IR 8547) deprecates 112-bit RSA/ECC after 2030 and disallows them after 2035. But most teams cannot answer the first question: where is our crypto? WHAT WE BUILT QSafe Scanner is one pipeline from scan to fix: 1. Scan — 10 detection rules for Python, JavaScript, Java and TLS configs, each finding with file, line, algorithm and severity. 2. Score — a 0–100 Quantum Readiness Score based on Mosca's inequality (X data lifetime + Y migration time > Z years to quantum). 3. Report — a CycloneDX 1.6 CBOM (crypto bill of materials) and SARIF 2.1.0, so results fit existing security tools. 4. Migrate — rewrites vulnerable code into a hybrid, crypto-agile design (X25519 + ML-KEM-768 → HKDF-SHA256 → AES-256-GCM) with the legacy algorithm kept behind a config flag. 5. Visualise — a Streamlit dashboard with live Mosca sliders, a findings table, a per-file chart, CBOM download and a Before vs After view. RESULTS On our intentionally vulnerable demo app: 4 files, 10 findings, 5 critical → score 0/100 CRITICAL. After migration: 0 findings → 100/100 QUANTUM READY, with 54 automated tests passing. The ML-KEM backend plugs in through liboqs; its live test switches on automatically when liboqs is installed. HOW IBM BOB POWERS IT Bob IDE is the core of the build: - Plan mode designed the architecture and task list. - Agent mode, guided by AGENTS.md and project rules, built the scanner, scorer, exporters, dashboard and tests. - Two custom Bob modes we created: "Quantum-Safe Auditor" (verifies findings and explains risk in plain English) and "PQC Migrator" (writes the post-quantum migration with tests). - A pqc-scan skill and /qscan slash command run the full audit in one step. - Every task summary is saved in the bob_sessions/ folder. The whole project used only a few Bobcoins. WHO IT HELPS Banks, government and healthcare — anyone with long-lived sensitive data — can turn a slow manual crypto audit into a repeatable scan. NEXT GitHub Action to block new vulnerable crypto in pull requests, live liboqs backend, more languages and certificate scanning, and an organisation-wide CBOM view. Team dualalpha: Sharmishtha Mazumdar & Kartik Tripathi