The Magnetic Pull of Mutable Protection: Worked Examples in Cryptographic Agility

...How do you go about fully understanding what cryptography you have, how it is used and if it's good or bad? This was the question we started to ask ourselves and set about trying to answer using static analysis tools such as GitHub's CodeQL.

Given how we all rely heavily on open-source projects, we set about scanning the top 1000 GitHub open-source projects to identify insecure cryptographic algorithms. We used GitHub's CodeQL multi-repository variant analysis to build a cryptographic bill …

analysis ask bad codeql cryptographic cryptography examples github good protection question static analysis tools understanding