The answer, up front
Quantum-vulnerable cryptography does not live in one place. It is scattered across seven distinct surfaces of a modern software stack, and the reason most organizations underestimate their exposure is simple: the tool they use inspects one surface and reports it clean, while the other six go unexamined.
The seven surfaces
- Source code. Hardcoded algorithms, key sizes, and cipher suites written directly into your application.
- Dependencies. Cryptography pulled in transitively through libraries you never audited.
- SBOMs and CBOMs. The declared inventory, which is only as accurate as the process that generated it.
- Certificates. TLS and code-signing certificates whose signature algorithms quietly age into risk.
- Infrastructure. Load balancers, service meshes, and managed services terminating cryptography outside your code.
- Binaries. Compiled artifacts where the algorithm is baked in and invisible to a source scan.
- Runtime tokens. JWTs, session tokens, and signed payloads generated and verified live in production.
Why single-surface tools mislead
A scanner that reads only source code will pass a repository whose real exposure lives in a five-year-old certificate or a vendored binary. The clean report is worse than no report, because it creates false confidence. Credible discovery has to span all seven surfaces at once.
Run QuCode to see where quantum-vulnerable cryptography actually lives in your stack.