· ReadyStack
Worked example
Real numbers from this tool, line by line.
1,560 days: that is how long the RSA-2048 key your AI assistant just generated has left before NIST IR 8547 deprecates it on 2030-12-31 — and on a 20-line provisioning script, 4 of the 15 findings are errors today. This is for security and platform engineers in the US and EU who ship code an assistant helped write.
The script
It is the file an assistant writes when you ask for "bootstrap keys and TLS for the new service": an RSA-2048 signing key, a leftover RSA-1024 key, a P-256 device key, an RS256 JWT, an RSA encrypt call with PKCS#1 v1.5 padding, an MD5 cache id, an AES cipher in ECB mode, an sshd snippet and an nginx line. Every line runs. Every line would pass a code review that asks "does it work".
What comes back on 2026-09-23
PQC Deprecation Lint runs 19 rules over it and returns 15 findings.
Four are errors today, before anyone mentions a quantum computer:
key_size=1024— RSA under 2048 bits, disallowed under NIST SP 800-131A Rev. 2.padding.PKCS1v15()— the Bleichenbacher padding-oracle class.hashlib.md5(payload)— collision-broken; an auditor cannot tell a cache key from an integrity check.HostKey /etc/ssh/ssh_host_dsa_key— OpenSSH 10.0, released 2025-04-09, removed DSA support entirely. A host on 10.x does not load that key.
The other eleven are on a clock. RSA key generation, the P-256 key, the RS256 token, the X25519 key agreement without ML-KEM, the SSH KexAlgorithms list and the nginx curve list all read "deprecated after 2030-12-31 — 1560 days from 2026-09-23". The SSH one carries a detail that is easy to miss: OpenSSH 10.0 already uses mlkem768x25519-sha256 by default, so an explicit list that leaves it out switches the post-quantum default off.
The date is an input
Move the date to 2031-03-01 and the same 15 findings come back as 13 errors. Move it to 2036-01-15 and the RSA line reads "disallowed since 2035-12-31 — not a plan any more, a finding". That is the number a migration plan needs: not "RSA is bad", but how many days the line in front of you has.
For US federal work the schedule got sharper on 2026-06-24. OMB M-26-15 tells agencies to align with IR 8547, move key establishment for high-value and high-impact systems to PQC during 2028-2030, move signatures in 2031, and support TLS 1.3 no later than 2030-01-02. The key-agreement, signature and TLS checks now carry those dates.
Why a chatbot does not catch it
Ask a chatbot whether rsa.generate_private_key(key_size=2048) is correct and it says yes, because it is. The question the standard asks is different: correct until when. The linter answers it per line, with the document it comes from and the concrete replacement — X25519MLKEM768, mlkem768x25519-sha256, ML-DSA-65 — not "consider migrating".
Free and paid
Checking the file you have open is free and unlimited in VS Code, and the same engine runs in the browser with nothing uploaded. The paid part is scope and ownership: one sweep across every file in the workspace and a dated pqcLint-report.md you keep for the migration ticket or the customer security questionnaire. $29 once. A security consultant doing the same inventory by hand bills $150-$250 an hour.
15 seconds — what it actually does
Questions people ask
What does PQC Deprecation Lint actually do?
PQC Deprecation Lint reads a code or config file and flags every quantum-vulnerable or already-retired algorithm line by line: RSA, ECDSA, EdDSA, ECDH, finite-field DH, DSA, SHA-1, MD5, 3DES, PKCS#1 v1.5 and AES-ECB. Each finding carries the NIST date that applies (deprecated after 2030-12-31, disallowed after 2035-12-31), the source document and a named replacement such as ML-KEM or ML-DSA.
Who is PQC Deprecation Lint for?
PQC Deprecation Lint is for security engineers, platform engineers and developers who ship code an AI assistant helped write, and who have to answer a customer security questionnaire, a FIPS review or a US federal post-quantum migration plan under OMB M-26-15. It fits teams that need a per-line cryptographic inventory of Python, JavaScript, Go, Java, sshd_config, nginx or Terraform files.
Why not just ask a chatbot or use a free scanner?
A chatbot asked whether rsa.generate_private_key with key_size 2048 is correct will say yes, because it is correct today. The question NIST IR 8547 asks is correct until when. PQC Deprecation Lint answers per line with a date you choose, and it also catches items that fail today, such as DSA host keys that OpenSSH 10.0 no longer loads.
What is free in PQC Deprecation Lint and what is paid?
Checking the file you have open in VS Code is free and unlimited, with every finding shown; the browser version is free too and uploads nothing. The paid licence, $29 once per person or CI seat, adds a sweep across every matching file in the workspace and writes a dated pqcLint-report.md you keep for tickets, audits and questionnaires.
What would the same crypto inventory cost done by a person?
A security consultant doing a cryptographic inventory by hand bills about $150 to $250 an hour. PQC Deprecation Lint produces the per-file findings and a dated whole-workspace report for $29 once, and the free single-file check shows the exact findings on your own code before anyone pays anything for the report.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. PQC Deprecation Lint — RSA/ECC after 2030 checks the file you open against 17 rules, each naming its legal or official basis, from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.