Imagine you are reviewing the code of a financial application and, among thousands of lines, you find a call to crypto.createSign('RSA-SHA256'). That single line — seemingly harmless — could compromise your entire system’s security against quantum computers. A few months ago at Q2BSTUDIO, we faced this real problem when a client asked us to audit their custom software for post-quantum cryptographic vulnerabilities. Building an AST scanner to detect these patterns was not only a fascinating technical challenge; it also pushed us to rethink how cybersecurity must evolve in the quantum computing era.
The idea was simple but ambitious: traverse all JavaScript and TypeScript files in a project, analyze the code without executing it, and point out exactly where algorithms like RSA, DSA, ECDSA, or SHA-256 are used. The problem is that a textual search with grep or includes fails miserably: comments, dynamic strings, or variables holding method names fool any regular expression. The solution we adopted is the same one we use in our AI and cloud services: working with Abstract Syntax Trees (AST).
An AST is a structural representation of source code that a parser generates after reading it. For example, the call crypto.createSign('RSA-SHA256') becomes a tree where the root is a CallExpression, its left child is a MemberExpression (with object crypto and property createSign), and the argument is a StringLiteral with value 'RSA-SHA256'. By traversing that tree with @babel/traverse, we can trigger an action every time we encounter a CallExpression node and check if it matches quantum-vulnerability patterns.
At Q2BSTUDIO, we apply this same technique on multiple fronts. On one hand, for cybersecurity projects where we need to audit hundreds of thousands of lines of legacy code. On the other hand, in cloud AWS/Azure solutions, where CI/CD pipelines must automatically reject any commit that introduces weak cryptography against quantum algorithms like Shor or Grover. And also in our BI/Power BI systems, where data integrity depends on robust digital signatures.
The scanner construction process began with choosing the right tools. @babel/parser lets us read any file (JS, JSX, TS, TSX, MJS, CJS) and generate the corresponding AST. We set sourceType: 'unambiguous' so the parser automatically decides whether the file uses ES modules or CommonJS, and we enable JSX and TypeScript plugins to cover React and TypeScript projects. Then, with @babel/traverse, we walk every node and record dangerous matches.
Detecting createSign with RSA or DSA is straightforward: when the traversal finds a CallExpression, we check that the callee is a MemberExpression with name createSign. Then we examine the first argument: if it is a string literal containing 'RSA' or 'DSA' (case-insensitive), we mark it as critical risk with weight 35. We do something similar for generateKeyPairSync: if the first argument is 'rsa' or 'ec', we label it critical. For createHash('sha256'), the risk is medium (weight 8) because SHA-256 is not vulnerable to Shor, but Grover reduces its effective security from 256 bits to ~128 bits.
But the scanner does not stop at a single file. We implemented a recursive directory walk, skipping folders like node_modules, .git, dist, or build. We only analyze .js, .jsx, .ts, .tsx, .mjs, .cjs extensions. That way, any project, no matter its size, can be audited in seconds. We also combine this AST analysis with a dependency scan (Layer 1): we check the package.json against a database of known libraries that use quantum-vulnerable cryptography, such as elliptic, ethers, or node-rsa. The final score is calculated as 100 - sum of weights, with deduplication to avoid penalizing the same finding twice.
One of the most striking surprises during development was discovering that many modern projects — even early-stage startups — use elliptic curves like secp256k1 (the same as Bitcoin) without realizing Shor breaks them completely. Companies that rely on ethers.js to sign blockchain transactions are exposing their digital assets to enormous risk. At Q2BSTUDIO, when we deploy process automation solutions or AI agents, we always include this kind of audit as part of our quality process.
The experience taught us that post-quantum security is not a distant topic. Quantum computers are advancing rapidly, and NIST standards are already defining replacement algorithms (like CRYSTALS-Kyber or Dilithium). Any code using RSA, DSA, ECDSA, or SHA-256 today should be migrated as soon as possible. Our AST scanner not only identifies those lines but also generates a report with weights that allow prioritizing fixes. For example, a critical finding with weight 35 deserves immediate attention, while a medium one with weight 8 can be planned mid-term.
In practice, this scanner has been integrated into CI/CD workflows for Q2BSTUDIO clients. When a developer pushes a commit that introduces crypto.createSign('RSA-SHA256'), the pipeline fails and the team receives a notification with the exact line and file. This prevents vulnerable code from reaching production. Additionally, for legacy projects, we offer a full audit service where we combine the AST scanner, dependency analysis, and manual penetration testing.
The key to success was not relying on regular expressions. The AST gives us a semantic understanding of the code: we know that crypto.createSign('RSA-SHA256') is a function call, not a comment. We can also handle complex cases like const sign = crypto.createSign; sign('RSA-SHA256') — though the method name is in a variable, the AST allows us to track the flow if we extend the analysis. For the first version we opted for simplicity, but capabilities are expandable.
Building this scanner was not just a technical exercise; it was a business decision. At Q2BSTUDIO, we understand that artificial intelligence and cloud computing must go hand in hand with security. That is why, every time we design a custom software solution, we incorporate cryptographic vulnerability detection from the start. Our clients in sectors like fintech, healthcare, or logistics especially value this proactive approach.
If you have a JavaScript or TypeScript project and want to know your quantum score, you can run our scanner with npx quantum-audit . (or with --json to integrate into CI). The result will show you each vulnerable line, its weight, and the algorithm involved. And if you prefer a professional audit, at Q2BSTUDIO we help you migrate to post-quantum cryptography and reinforce your entire infrastructure on AWS, Azure, or Google Cloud. The quantum era is already here. Is your code ready?
