CBOM Atlas
We scanned 109 public codebases with our prototype on 18 Sep 2026. Every row links to the CycloneDX 1.7 Cryptographic Bill of Materials we produced, signed with ML-DSA-65 (FIPS 204), together with its human-readable report and VEX file.
109
public repositories, one signed CBOM each
9,481
cryptographic assets inventoried
37 s
median scan time per repository
100%
CycloneDX 1.7 schema-valid and ML-DSA-65 signed
By category
| category | repos | quantum-vulnerable crypto in production | crypto broken today | already use post-quantum | CERT-In avg |
|---|---|---|---|---|---|
| India digital public infrastructure (open source) | 28 | 75% | 32% | 0% | 61% |
| Identity, auth and token libraries | 17 | 71% | 41% | 12% | 61% |
| PKI, certificates and TLS tooling | 12 | 100% | 92% | 33% | 76% |
| SSH, VPN and secure transport | 11 | 91% | 82% | 54% | 65% |
| General-purpose crypto libraries | 13 | 54% | 38% | 31% | 72% |
| Payments, banking and blockchain | 11 | 64% | 54% | 9% | 72% |
| Messaging, storage and collaboration platforms | 7 | 86% | 71% | 57% | 60% |
| Post-quantum reference implementations (control group) | 10 | 30% | 20% | 100% | 84% |
Every repository
| repository | category | data kept for | observed | exposed | act now | monitor | quantum-vulnerable in production | post-quantum | CERT-In | files |
|---|
How to check our work
git clone <ecdat repo> && cd ecdat && pip install -e . ecdat verify r/<repo>/cbom.json --pubkey ../ecdat-mldsa65.pub
"Observed" means we found it in the project's own code, configuration, certificates or binaries. Algorithms a dependency merely can provide we list in the CBOM as dependency inventory (781 of them) and never count as use. "Data kept for" is the assumption that drives Mosca's rule for that repository; change it and the tiers change. Quantum-vulnerable algorithms such as RSA are today's global default, not a flaw in any one project. Maintainers who want a row changed or removed can open an issue.