DEV Community

Cover image for How to Gate Your CI Pipeline on Quantum Vulnerability — with quantum-audit
takundanashebmuchena-pixel
takundanashebmuchena-pixel

Posted on

How to Gate Your CI Pipeline on Quantum Vulnerability — with quantum-audit

#security #javascript #devops #github

Part 3 of the quantum-audit series. Part 1 | Part 2*

🌐 Tool: quantum-audit-site.vercel.app

Most security tools tell you there's a problem. Then you close the tab and forget about it.

The only way to actually fix that is to make the problem block your deployment.

quantum-audit exits with a non-zero code when it finds critical quantum-vulnerable cryptography. That means you can drop it into any CI pipeline and have it fail the build automatically.

Here's how.

The exit code behaviour 

npx quantum-audit .
echo $?   # 0 = no critical findings, 1 = critical findings found
Enter fullscreen mode Exit fullscreen mode
  • Exit 0 — no critical findings (safe to deploy)
  • Exit 1 — critical findings detected (block the build)

Medium findings (SHA-256, AES-128) don't fail the build — they appear in the output as warnings but don't block deployment. Only CRITICAL findings (RSA, ECDSA, secp256k1) cause a non-zero exit.

GitHub Actions

Add this to your .github/workflows/ci.yml:

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  quantum-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Run quantum-audit
        run: npx quantum-audit .
Enter fullscreen mode Exit fullscreen mode

If your project uses ethers, web3, elliptic, or any other ECDSA/RSA library — the step will fail and your PR cannot be merged until the finding is addressed.

JSON output for custom reporting

Need to parse the results programmatically? Use the --json flag:

npx quantum-audit . --json
Enter fullscreen mode Exit fullscreen mode

Output:

{
  "project": "my-dapp",
  "score": 60,
  "grade": "C — Moderate Exposure",
  "findings": [
    {
      "algorithm": "ECDSA (secp256k1) signing",
      "risk": "critical",
      "weight": 40,
      "file": "package.json",
      "line": null,
      "source": "ethers"
    },
    {
      "algorithm": "SHA-256 (crypto.createHash)",
      "risk": "medium",
      "weight": 8,
      "file": "src/utils/hash.js",
      "line": 14
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

You can pipe this into a Slack notification, a dashboard, or a custom reporting step.

Slack notification on failure

Here's a GitHub Actions step that posts to Slack when critical findings are detected:

- name: Run quantum-audit
  id: audit
  run: npx quantum-audit . --json > audit-result.json || true

- name: Check for critical findings
  run: |
    SCORE=$(cat audit-result.json | python3 -c "import sys,json; print(json.load(sys.stdin)['score'])")
    echo "Quantum readiness score: $SCORE"
    if [ "$SCORE" -lt 70 ]; then
      echo "CRITICAL: Quantum exposure score below threshold"
      exit 1
    fi
Enter fullscreen mode Exit fullscreen mode

Soft mode — warn without blocking

If you're not ready to hard-fail on critical findings yet, use this pattern:

- name: Run quantum-audit (warn only)
  run: npx quantum-audit . || echo "⚠️ Quantum vulnerabilities detected — review before next release"
  continue-on-error: true
Enter fullscreen mode Exit fullscreen mode

This surfaces the findings in your CI logs without blocking the build. Good for teams that need a transition period before enforcing the gate.

What to do when the build fails

If quantum-audit fails your build, you have three options:

Option 1 — Accept the risk temporarily
Use continue-on-error: true in your CI step to warn without blocking while you plan a migration.

Option 2 — Migrate to a post-quantum library
NIST standardized the replacements in 2024:

  • CRYSTALS-Dilithium — drop-in for ECDSA signatures
  • CRYSTALS-Kyber — for key encapsulation
  • SPHINCS+ — hash-based signatures (most conservative choice)

Option 3 — Scope the scan
If the vulnerable dependency is isolated to a specific non-critical part of your codebase, you can scope the scan:

npx quantum-audit ./src/critical-path
Enter fullscreen mode Exit fullscreen mode

Only scan the directories that matter most.

Full workflow example

Here's a complete GitHub Actions workflow with quantum-audit integrated alongside your existing checks:

name: Security checks

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm install

      - name: npm audit (classical vulnerabilities)
        run: npm audit --audit-level=high

      - name: quantum-audit (quantum vulnerabilities)
        run: npx quantum-audit .

      - name: quantum-audit JSON report
        if: always()
        run: npx quantum-audit . --json > quantum-report.json

      - name: Upload quantum report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: quantum-audit-report
          path: quantum-report.json
Enter fullscreen mode Exit fullscreen mode

This runs both npm audit (for classical CVEs) and quantum-audit (for quantum exposure) side by side, and uploads the full JSON report as a build artifact for review.

Install 

npm install -g quantum-audit
# or
npx quantum-audit .
Enter fullscreen mode Exit fullscreen mode

GitHub: takundanashebmuchena-pixel/quantum-audit
npm: npmjs.com/package/quantum-audit

Are you running quantum-audit in CI? Drop your setup in the comments — I'd love to see how others are integrating it.

Top comments (2)

Collapse
 
frank_signorini profile image
Frank •

How does quantum-audit handle hybrid classical-quantum systems, I'm curious to know if it can audit both types simultaneously. Would love to hear your thoughts on this, been following your series for more insights on quantum security.

Collapse
 
takundanashebmuchenapixel profile image
takundanashebmuchena-pixel •

Hey Frank, appreciate you reading! quantum-audit currently scans for imports and usage of quantum-vulnerable crypto primitives — so in a hybrid system, it would surface the classical components (e.g., ECDSA in a hybrid TLS handshake) as findings. It doesn't yet have a "hybrid-aware" mode that suppresses warnings when a PQC fallback is present, but that's an interesting feature idea. Are you working with something specific like OpenSSL 3.x's provider system or a custom hybrid protocol? Would love to understand the use case better.