<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Weak Cryptographic Implementations

## semgrep

### Synopsis

```bash
semgrep --config <ruleset> [--include <glob>] <target>
```

### Crypto-Relevant Rulesets

| Ruleset | Description |
|---|---|
| `p/owasp-top-ten` | OWASP Top 10 including A02 Cryptographic Failures |
| `p/insecure-transport` | HTTP, unencrypted connections |
| `p/secrets` | Hardcoded secrets and credentials |
| `p/python` | Python-specific security rules |
| `p/java` | Java-specific security rules |

## trufflehog

### Synopsis

```bash
trufflehog filesystem --directory <path> [--only-verified]
trufflehog git file://<repo> [--since-commit <hash>]
```

### Options

| Option | Description |
|---|---|
| `--only-verified` | Only report secrets confirmed active |
| `--json` | JSON output for parsing |
| `--include-detectors` | Filter by detector type |

## CWE Reference

| CWE | Title |
|---|---|
| CWE-326 | Inadequate Encryption Strength |
| CWE-327 | Use of Broken or Risky Crypto Algorithm |
| CWE-328 | Use of Weak Hash |
| CWE-330 | Use of Insufficiently Random Values |
| CWE-916 | Use of Password Hash With Insufficient Effort |
| CWE-798 | Use of Hardcoded Credentials |

## Agent Script

```bash
# Scan Python code for weak crypto
node agent.js scan src/ --language python

# Check remote TLS cipher strength
node agent.js tls example.com

# Scan for hardcoded secrets
node agent.js secrets .
```
