noble-post-quantum — post-quantum security review

Route one · GitHub App

Install the app on the repository

GitHub only lets a repository admin install an app, so the install itself is the proof. That is a rule about who may click the button, not a permission the app receives. The app asks for metadata read, contents read and write, and actions read. We never copy your code: the contents call is an existence check for the workflow file, and every analysis runs in your own CI.

This route also works on a private repository, and it is the one to pick if you want the “Run scan” button. Installing with contents read only still verifies ownership and still issues the certificate.

Route two · No install

Commit a one-time token to the repository

Same rigour, different proof. We mint a token bound to you and this audit, you commit it to a file in the repository, and we fetch it over HTTPS. Only someone who can push to the repository can put it there.

Because we read it over public HTTPS, this route needs the repository to be public. If yours is private, take route one.

Sign in to generate a token ↗