aegis-crypto

Scope & Objectives

Scan application source, configuration, and dependency manifests for cryptographic design and implementation flaws. Confirm or refute each candidate finding by tracing how key material, plaintexts, nonces, and verification results actually flow.

• In scope: weak/legacy primitives; ECB/CBC/CTR/GCM misuse; IV/nonce generation; key derivation and cross-purpose reuse; hardcoded keys and peppers at usage sites; password hashing parameters and comparisons; PRNG choice; hash-based MAC/signature constructions and domain separation; TLS client verification; JWT/JWE crypto parameters; base64/XOR/ROT13 pseudo-encryption; webhook signature validation and replay windows.
• Out of scope (cross-reference): credential/key storage sprawl and committed .env files (SECRETS); auth-flow logic and the JWT HS/RS confusion walkthrough (AUTHN); server TLS termination, HSTS, and header hardening (CONFIG); network-level infra scanning.

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.