pqcheck 0.1.0 → 0.1.1

package/README.md

@@ -0,0 +1,112 @@
+# pqcheck
+
+> **Public Surface Blast Radius scanner** — find out how much of your data unlocks when quantum decryption arrives.
+
+```bash
+npx pqcheck chase.com
+```
+
+That's it. No install. Works from any terminal with Node 18+.
+
+---
+
+## What it does
+
+`pqcheck` scans any HTTPS domain and computes its **Decryption Blast Radius Score** — the first continuous metric for harvest-now-decrypt-later (HNDL) risk. Every other TLS scanner answers "is post-quantum cryptography enabled?" with a yes/no. `pqcheck` answers the question that actually matters: *if an adversary harvests this traffic today and decrypts it in 2035, how much past + future data unlocks?*
+
+The score combines:
+- **Cipher-class probing** — does the server accept RSA fallback even if it prefers ECDHE?
+- **Certificate chain analysis** — including the intermediate cert (the chain's actual quantum failure point)
+- **Public-key reuse across rotations** — detects when the same private key has been live across multiple cert renewals (often 4+ years at large enterprises)
+- **Subject scale** — wildcard certs and subdomain count multiplying the blast radius
+
+## Example
+
+```
+$ npx pqcheck chase.com
+
+  chase.com
+  ─────────────────────────────────────
+  PUBLIC SURFACE BLAST RADIUS: 5.6 / 10 (MEDIUM)
+
+  Public surface signals:
+  • TLS:           TLSv1.3 (TLS_AES_128_GCM_SHA256)
+  • Hybrid PQC:    no
+  • Cert expires:  in 127 days
+  • HSTS:          not detected
+  • Subdomains:    47 (wildcard cert)
+
+  Findings:
+  [HIGH] Same RSA-2048 key reused for 4.2 years across 3 cert rotations
+  [HIGH] ECDHE-only — quantum-vulnerable key exchange
+  [MED]  Wildcard cert spans 47 subdomains
+
+  ⚠  This is the PUBLIC surface only.
+  Internal Blast Radius is typically 12–40× the public score.
+
+  Plain-English impact:
+  If quantum decryption arrives in 2030–2040, harvested traffic from
+  chase.com (US banks) would unlock 4.2 years of session data, across
+  47 subdomains under one wildcard cert.
+
+  → Full report: https://quantapact.com/?check=chase.com
+```
+
+## Usage
+
+```
+npx pqcheck <domain>           Scan and print human-readable report
+npx pqcheck <domain> --json    Output raw JSON for piping / scripting
+npx pqcheck --help             Show all options
+npx pqcheck --version          Show version
+```
+
+The `--json` flag is useful for integrating into CI / monitoring tools:
+
+```bash
+# In a GitHub Actions workflow:
+SCORE=$(npx pqcheck mybank.com --json | jq '.score')
+if (( $(echo "$SCORE > 7" | bc -l) )); then
+  echo "Score regressed above threshold"; exit 1
+fi
+```
+
+## Web version
+
+Same scanner, browser-friendly UI: **[quantapact.com](https://quantapact.com)**
+
+Shareable per-domain reports at `quantapact.com/r/<domain>` — the URL unfurls in Twitter / Slack / LinkedIn with a dynamically-generated card showing the grade.
+
+## Public leaderboard
+
+Sector rankings updated nightly across:
+
+- US Banks (20 peers)
+- US Healthcare Systems (20 peers)
+- Major SaaS / Cloud Platforms (30 peers)
+- US Federal Government (25 peers)
+- Major EU & UK Banks (25 peers)
+- US Defense Contractors (15 peers)
+- Global Automakers (15 peers)
+- Global News & Media (15 peers)
+- US Telecom & ISPs (15 peers)
+- US Airlines (10 peers)
+- UK Government & Public Services (15 peers)
+
+→ **[quantapact.com/leaderboard.html](https://quantapact.com/leaderboard.html)**
+
+## Methodology
+
+The Decryption Blast Radius scoring methodology is fully open and documented at **[quantapact.com/methodology](https://quantapact.com/methodology)**. Citable; methodology paper coming soon.
+
+## Privacy
+
+`pqcheck` sends the domain you scan to the Quantapact API (so the actual TLS handshake can be performed from the public internet). No other data is sent — no email, no IP-tied identifier, nothing client-side. The server-side `/api/scan` endpoint stores anonymous scan results in a 30-minute cache to avoid duplicate scans of the same domain. See [quantapact.com/privacy](https://quantapact.com/privacy) for full details.
+
+## License
+
+MIT. © 2026 Quantapact.
+
+## Disclaimer
+
+`pqcheck` measures only the **public** surface of a domain — what's observable from the open internet. Internal Blast Radius (east-west traffic, internal databases, VPN tunnels, backup pipelines) is typically 12–40× the public score depending on sector. A passing public-surface grade does **not** mean low internal exposure.

package/bin/pqcheck.js

@@ -7,7 +7,7 @@
 // =============================================================================
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://quantapact.com";
-const VERSION = "0.1.0";
+const VERSION = "0.1.1";
 
 const ANSI = {
   reset:   "\x1b[0m",
@@ -137,6 +137,8 @@ function printReport(r) {
   }
 
   console.log(color("violet", `  → Full report: ${API_BASE}/?check=${encodeURIComponent(r.domain)}`));
+  console.log(color("dim",    `  → Share this:  ${API_BASE}/r/${encodeURIComponent(r.domain)}`));
+  console.log(color("dim",    `  → Compare two: ${API_BASE}/compare?a=${encodeURIComponent(r.domain)}&b=`));
   console.log("");
 }
 

package/package.json

@@ -1,20 +1,29 @@
 {
   "name": "pqcheck",
-  "version": "0.1.0",
-  "description": "Public Surface Blast Radius scanner — quantum-decryption risk in your terminal.",
+  "version": "0.1.1",
+  "description": "Decryption Blast Radius scanner — find out how much of your data unlocks when quantum decryption arrives.",
   "keywords": [
     "post-quantum",
     "cryptography",
     "security",
     "tls",
+    "ssl",
     "scanner",
     "harvest-now-decrypt-later",
     "hndl",
     "blast-radius",
-    "pqc"
+    "pqc",
+    "quantum",
+    "crypto-audit",
+    "crypto-inventory"
   ],
   "homepage": "https://quantapact.com",
   "bugs": "https://quantapact.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mzon7/quantapact.git",
+    "directory": "cli"
+  },
   "license": "MIT",
   "author": "Quantapact",
   "type": "module",
@@ -25,6 +34,7 @@
     "pqcheck": "./bin/pqcheck.js"
   },
   "files": [
-    "bin/"
+    "bin/",
+    "README.md"
   ]
 }