Scan your configs & IaC
Config files declare cryptography your code never mentions: the cipher suites nginx will accept, the key spec Terraform will mint, the SSH keys allowed into a box. PQLens reads the declarations, so tomorrow’s crypto is in today’s inventory.
How it works
- Open the Config tab and pick a repo or config folder.
- Web-server TLS settings (nginx, Apache, HAProxy) are parsed: protocol floors and cipher lists.
- Terraform and cert-manager resources are read for the key algorithms and sizes they will create.
- SSH
authorized_keysfiles are inventoried by key algorithm and size.
Declared crypto is a leading indicator
A live TLS probe tells you what a server negotiated today; the nginx config tells you everything it would accept, including the TLS 1.0 floor someone set in 2015. And a Terraform module that requests RSA-2048 keys will keep minting quantum-vulnerable keys with every apply until the module changes. Fixing the declaration fixes the future — which is why config is its own surface.
Pairs well with a live TLS scan
Scan the config, then probe the live endpoint of the same service — the difference between what a config declares as acceptable and what actually gets negotiated today is often the most useful finding.
Frequently asked questions
Which config formats are understood?
nginx, Apache and HAProxy TLS settings; Terraform and cert-manager key/certificate specs; and SSH authorized_keys files.
Does it change or lint my configs?
No. It is read-only discovery, run entirely in your browser — it reports what the files declare and classifies it; it never rewrites anything, and the files never leave the tab.
Why scan configs when I can probe the live endpoint?
The live probe shows one negotiated result; the config shows the full accepted range and what future infrastructure will be created with. You want both in the inventory.