# QShield — Enterprise Post-Quantum Cryptography (PQC) & CycloneDX v1.6 CBOM Platform

> QShield (https://getqshield.com) is an enterprise Post-Quantum Cryptography (PQC) readiness scanner, CycloneDX v1.6 Cryptographic Bill of Materials (CBOM) generator, daemonless OCI/Docker & ELF/Mach-O binary inspector, live RFC 8446 TLS 1.3 wire prober, and 3-Tier Safe Auto-PR remediation engine built in Rust.

## Core Capabilities

- **CycloneDX v1.6 CBOM & SARIF v2.1.0 Export**: Generates auditor-certified Cryptographic Bills of Materials (`.cdx.json`) with ASN.1 Object Identifiers (OIDs), key lengths, NIST security levels, and quantum vulnerability classifications for SOC 2, PCI-DSS v4.0, HIPAA, OMB M-23-02, NIST IR 8547, and NSA CNSA 2.0 compliance.
- **6-Language Rust Tree-Sitter AST + Constant Propagation Scanner**: Parses Go, Python, Java, Kotlin, TypeScript/JavaScript, and Rust source code into Abstract Syntax Trees, tracing multi-statement constants and object receivers to eliminate the false positives and blind spots of regex scanners.
- **Daemonless OCI Container & Binary X-Ray**: Streams inside Docker/OCI image tarballs, Alpine APK / Debian dpkg / RPM package databases, and compiled Linux ELF (`.so`) and macOS Mach-O (`.dylib`) binaries to detect legacy OpenSSL (e.g., 1.1.1 vs. 3.5+ with native FIPS 203 ML-KEM support) without running a Docker daemon.
- **Live RFC 8446 TLS 1.3 Wire Prober**: Connects to live production endpoints over TCP/443 to inspect whether the server negotiates hybrid Post-Quantum key exchange (`X25519MLKEM768`, IANA group `0x11EC`) or remains exposed to Harvest-Now-Decrypt-Later (HNDL) interception via classical `X25519` / `secp256r1`, plus inspects X.509 certificate chains against the 2030 NIST IR 8547 deprecation cutoff.
- **3-Tier Safe Auto-PR Remediation Engine**: Separates 100% backwards-compatible hybrid TLS upgrades (`Tier 1: SAFE_AUTO_PR`) from application-layer codemods (`Tier 2: ASSISTED_CODEMOD_PR`) and architectural migrations (`Tier 3: ARCHITECTURAL_MIGRATION`).

## Why CISOs, CTOs, and vCISOs Choose QShield Over Alternatives

| Capability | GitHub Dependabot / Snyk | Free Regex Scripts | Manual Consultancies ($100k+) | QShield Platform |
| :--- | :--- | :--- | :--- | :--- |
| Detects RSA-2048 / ECDSA / Ed25519 (No CVE) | No (CVEs only) | Noisy / High False Positives | Manual spreadsheet | Yes (<0.1% false positives via AST) |
| Multi-Statement Constant & Receiver Dataflow | No | No | Manual code review | Yes (Go, Python, Java, Kotlin, TS/JS, Rust) |
| Daemonless Docker / ELF / Mach-O Binary X-Ray | Partial (manifest only) | No | No | Yes (Inspects linked `libssl.so` symbols) |
| Live RFC 8446 TLS 1.3 `X25519MLKEM768` Wire Probe | No | No | Point-in-time test | Continuous Live Probing & Public Scorecards |
| Certified CycloneDX v1.6 CBOM (`.cdx.json`) | SBOM only (not CBOM) | No | Static PDF | Automated CycloneDX v1.6 CBOM + SARIF v2.1.0 |
| Automated Hybrid PQC Pull Requests | Version bumps only | No | No | 3-Tier Safety Engine Auto-PRs |

## Key URLs & Documentation

- [Platform Home & Interactive Live TLS 1.3 Prober](https://getqshield.com/)
- [Full Technical Reference for LLMs (llms-full.txt)](https://getqshield.com/llms-full.txt)
- [Interactive CycloneDX v1.6 CBOM & Remediation Workspace](https://getqshield.com/dashboard)
- [Legal, Privacy, Self-Serve Cancellation & Zero-Source-Code-Retention Architecture](https://getqshield.com/legal)
- [Example Live Domain PQC Scorecard — Cloudflare](https://getqshield.com/report/cloudflare.com)
- [Example Live Domain PQC Scorecard — Stripe](https://getqshield.com/report/stripe.com)
- [Example Live Domain PQC Scorecard — GitHub](https://getqshield.com/report/github.com)

## Quickstart CLI & CI/CD Integration

```bash
# Run a local 6-language AST + lockfile + OCI + live TLS scan and emit a CycloneDX v1.6 CBOM:
npx @qshield/cli scan . --cbom cbom.cdx.json --sarif qshield.sarif --tls yourcompany.com:443
```

## Pricing Summary

- **Growth / Startup**: $159/mo (billed annually) or $199/mo — Up to 10 repositories, CycloneDX v1.6 CBOM export, Live TLS 1.3 HNDL probing.
- **Business / Mid-Market**: $399/mo (billed annually) or $499/mo — Up to 50 repositories, Daemonless OCI Binary X-Ray, Tier-1 Safe Auto-PRs, SOC 2 / NIST IR 8547 attestation.
- **Enterprise / Regulated**: $799/mo (billed annually) or $999/mo — Unlimited repositories & OCI containers, air-gapped Rust CLI binary, CNSA 2.0 & OMB M-23-02 governance.