Hash-based post quantum signatures in Rust
This report summarizes scanner evidence for QuipNetwork/hashsigs-rs, a Rust project with 11,212 GitHub stars. SynthScan examined 33,726 lines of code across 140 source files, recording 244 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 8.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 222 finding(s).
Are imports declared and package/API names verified? 9 finding(s).
Are wrappers, guards, and repeated structures necessary? 47 finding(s).
Which changes need focused human review? 244 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 244 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 61 | # hashsigs-py-common. Pinning it here is what stops seven manifests drifting. | COMMENT |
| LOW | Cargo.toml | 81 | # Counts stay compile-time constants (no runtime params struct): each profile | COMMENT |
| LOW | deny.toml | 1 | # cargo-deny configuration — supply-chain policy enforced in CI (the | COMMENT |
| LOW | build.rs | 61 | default_cfg: "shrincs_default_profile_128s_q20_sha2", | COMMENT |
| LOW | .vale.ini | 1 | [*.{md,txt,rst}] | COMMENT |
| LOW | .gitlab-ci.yml | 1 | # CI for hashsigs-rs. | COMMENT |
| LOW | .gitlab-ci.yml | 21 | # shared runner needs only Node + npm. Shared runners must be enabled on the | COMMENT |
| LOW | .gitlab-ci.yml | 41 | # pypi a release can be deleted, but its filenames can never be reused | COMMENT |
| LOW | .gitlab-ci.yml | 61 | CARGO_SEMVER_CHECKS_VERSION: "0.49.0" | COMMENT |
| LOW | .gitlab/ci/release.yml | 61 | rules: | COMMENT |
| LOW | .gitlab/ci/release.yml | 241 | # reject on its platform tag. Both failures are silent until too late: | COMMENT |
| LOW | .gitlab/ci/release.yml | 261 | # | COMMENT |
| LOW | .gitlab/ci/release.yml | 281 | # Nothing here consumes another job's artifacts; ordering is expressed with | COMMENT |
| LOW | .gitlab/ci/release.yml | 301 | - export PATH="/tmp/py-venv/bin:${CARGO_HOME}/bin:${PATH}" | COMMENT |
| LOW | .gitlab/ci/test.yml | 201 | - !reference [.install-python-build, before_script] | COMMENT |
| LOW | .gitlab/ci/setup.yml | 1 | # Pin every job to the self-hosted Linux fleet (lovelace/watch/finney all carry | COMMENT |
| LOW | py/hashsigs_build.py | 361 | COMMENT | |
| LOW | py/common/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/common/src/lib.rs | 21 | //! [`hashsigs_rs::bindings`], the profile-generic core the WebAssembly surface | COMMENT |
| LOW | py/common/src/lib.rs | 101 | /// | COMMENT |
| LOW | py/profiles/p128s_q20_sha2/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/profiles/p128s_q18/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/profiles/p128s_q20/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/profiles/p256s/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/profiles/p256s_sha2/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/profiles/p128s_q18_sha2/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | py/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | bin/build-wasm.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | bin/build-wasm.sh | 61 | feature="$(PROFILE_FEATURE "$profile")" | COMMENT |
| LOW | bin/npm-dists.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | bin/npm-dists.sh | 41 | fi | COMMENT |
| LOW | bin/sync-versions.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | bin/sync-versions.sh | 21 | COMMENT | |
| LOW | bin/packages.sh | 1 | # shellcheck shell=bash | COMMENT |
| LOW | bin/packages.sh | 21 | # Sourced by every build, check and publish script so none of them can hold a | COMMENT |
| LOW | bin/packages.sh | 41 | # This replaces an earlier sibling-package model, where each opt-in profile was | COMMENT |
| LOW | bin/packages.sh | 81 | COMMENT | |
| LOW | bin/tests/test-packages.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | bin/tests/test-sync-versions.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/alloc_budget.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/generate_stateful_gas_vector.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/test_vectors.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/generate_shrincs_vectors.rs | 21 | // filename. Emitting the non-default profiles requires building this test crate | COMMENT |
| LOW | tests/compile_fail.rs | 1 | #[test] | COMMENT |
| LOW | tests/solidity_account_vectors.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/envelope_vectors.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/compile_fail/matched_widths.rs | 1 | use hashsigs_rs::profiles::p256s::Profile256s; | COMMENT |
| LOW | tests/common/mod.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | tests/common/mod.rs | 21 | //! | COMMENT |
| LOW | solana/tests/solana_unit_tests.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | solana/examples/shrincs-account/src/processor.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | solana/examples/shrincs-account/src/processor.rs | 21 | //! prior to its removal at `5e13d35~1`), adapted to build on this crate's | COMMENT |
| LOW | solana/examples/shrincs-account/src/processor.rs | 301 | } | COMMENT |
| LOW | solana/examples/shrincs-account/src/processor.rs | 581 | state.recovery_mode = false; | COMMENT |
| LOW | solana/examples/shrincs-account/src/processor.rs | 821 | /// ERC-1271-style read-only query, ported from the deleted wasm host | COMMENT |
| LOW | solana/examples/shrincs-account/src/lib.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | solana/examples/shrincs-account/src/state.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| LOW | solana/examples/shrincs-account/src/state.rs | 21 | //! (`solana/src/account.rs` prior to its removal at `5e13d35~1`). That | COMMENT |
| LOW | solana/examples/shrincs-account/src/state.rs | 61 | /// # Borsh exception | COMMENT |
| LOW | solana/examples/shrincs-account/src/rotation.rs | 1 | // Copyright (C) 2026 quip.network | COMMENT |
| 125 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | py/hashsigs_build.py | 98 | def _ensure_workspace_members(profiles: list[dict]) -> None: | CODE |
| LOW | py/python/hashsigs/_api.py | 140 | def shrincs_import_signing_key( | CODE |
| LOW⚡ | py/python/hashsigs/_api.py | 154 | def shrincs_compute_public_key_commitment(self, secret_key: bytes) -> bytes: ... | CODE |
| LOW⚡ | py/python/hashsigs/_api.py | 155 | def shrincs_recover_public_key_commitment(self, signature: bytes) -> bytes: ... | CODE |
| LOW⚡ | py/python/hashsigs/_api.py | 158 | def _sphincs_keys_from_secret_bytes(secret: bytes) -> SphincsPlusCKeys: | CODE |
| LOW⚡ | py/python/hashsigs/_api.py | 166 | def _sphincs_keys_to_secret_bytes(keys: SphincsPlusCKeys) -> bytes: | CODE |
| LOW | py/python/hashsigs/_api.py | 210 | def shrincs_keys_to_secret_bytes(keys: ShrincsKeys) -> bytes: | CODE |
| LOW | py/python/hashsigs/_api.py | 355 | def compute_public_key_commitment(self, keys: ShrincsKeys) -> bytes: | CODE |
| LOW | py/python/hashsigs/_api.py | 361 | def recover_public_key_commitment(self, signature: bytes) -> bytes: | CODE |
| LOW | py/tests/test_profiles.py | 49 | def test_manifest_and_package_agree_on_the_profile_set(): | CODE |
| LOW | py/tests/test_profiles.py | 57 | def test_module_reports_its_own_profile(entry): | CODE |
| LOW⚡ | py/tests/test_profiles.py | 73 | def test_no_two_profiles_report_the_same_name(): | CODE |
| LOW⚡ | py/tests/test_profiles.py | 83 | def test_every_profile_reports_the_same_crate_version(): | CODE |
| LOW⚡ | py/tests/test_profiles.py | 89 | def test_a_signature_does_not_verify_under_another_profile(): | CODE |
| LOW | py/tests/test_profiles.py | 110 | def test_importing_a_key_under_the_wrong_profile_is_rejected(): | CODE |
| LOW | py/tests/test_profiles.py | 131 | def test_round_trip_through_each_fast_profile(module): | CODE |
| LOW | py/tests/test_profiles.py | 148 | def test_the_package_root_is_the_default_profile(): | CODE |
| LOW | py/tests/test_api.py | 26 | def test_shrincs_keygen_shapes(): | CODE |
| LOW | py/tests/test_api.py | 49 | def test_keygen_is_deterministic_for_the_same_seed(): | CODE |
| LOW | py/tests/test_api.py | 55 | def test_sign_verify_round_trip_and_rejections(): | CODE |
| LOW | py/tests/test_api.py | 73 | def test_each_sign_consumes_one_leaf_and_the_signatures_differ(): | CODE |
| LOW | py/tests/test_api.py | 87 | def test_stateful_signing_raises_once_the_budget_is_spent(): | CODE |
| LOW | py/tests/test_api.py | 101 | def test_persistence_round_trip_preserves_the_leaf_counter(): | CODE |
| LOW | py/tests/test_api.py | 117 | def test_import_rejects_a_tampered_secret_and_a_short_one(): | CODE |
| LOW | py/tests/test_api.py | 131 | def test_stateless_signing_consumes_no_leaf(): | CODE |
| LOW | py/tests/test_api.py | 144 | def test_reset_changes_the_commitment_and_keeps_the_stateless_half(): | CODE |
| LOW | py/tests/test_api.py | 161 | def test_recover_public_key_commitment(): | CODE |
| LOW | py/tests/test_api.py | 172 | def test_keygen_rejects_an_out_of_range_budget(): | CODE |
| LOW | py/tests/test_api.py | 182 | def test_sphincs_plus_c_round_trip(): | CODE |
| LOW | py/tests/test_api.py | 194 | def test_a_wrong_length_message_is_rejected_when_signing(): | CODE |
| LOW⚡ | ts/src/api.ts | 120 | function sphincsPlusCKeysToSecretBytes(keys: SphincsPlusCKeys): Uint8Array { | CODE |
| LOW⚡ | ts/src/api.ts | 125 | function sphincsPlusCKeysFromSecretBytes(secret: Uint8Array): SphincsPlusCKeys { | CODE |
| LOW⚡ | ts/src/api.ts | 133 | function sphincsPlusCPublicKeyToBytes(publicKey: { pkSeed: Uint8Array; root: Uint8Array }): Uint8Array { | CODE |
| LOW | ts/src/api.ts | 180 | function shrincsKeysFromSecretBytes(secret: Uint8Array, publicKeyCommitment: Uint8Array): ShrincsKeys { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | py/hashsigs_build.py | 357 | # ── PEP 517 hooks ──────────────────────────────────────────────────────── | STRING |
| MEDIUM | ts/src/api.ts | 51 | // ── noble-style Uint8Array API ────────────────────────────────────────── | COMMENT |
| MEDIUM | ts/src/api.ts | 378 | // ── compile-time conformance (zero emit, zero runtime) ─────────────────── | COMMENT |
| MEDIUM | src/bindings.rs | 71 | // ── Length-checked field parsers ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/bindings.rs | 172 | // ── SPHINCS+C ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/bindings.rs | 225 | // ── SHRINCS ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/wasm/mod.rs | 189 | // ── The generic core, exercised at more than one profile ──────────────── | COMMENT |
| MEDIUM | src/wasm/mod.rs | 317 | // ── Noble-style Uint8Array API: round trips at the Rust level ────────── | COMMENT |
| MEDIUM | src/shrincs/uxmss.rs | 234 | // ── Structured, newtyped UXMSS key (the SHRINCS stateful fast path) ────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | py/hashsigs_build.py | 24 | CODE | |
| LOW | py/hashsigs_build.py | 34 | CODE | |
| LOW | py/python/hashsigs/_api.py | 21 | CODE | |
| LOW | py/python/hashsigs/_api.py | 26 | CODE | |
| LOW | py/tests/test_profiles.py | 19 | CODE | |
| LOW | py/tests/test_api.py | 13 | CODE | |
| LOW | bin/check-wheel.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | py/python/hashsigs/_api.py | 159 | """Split the 128-byte flat secret: skSeed || prfSeed || pkSeed || root.""" | STRING |
| HIGH | py/python/hashsigs/_api.py | 179 | """Flatten to the 64-byte ``pkSeed || root`` the verify calls take.""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 151 | # Compile-fail harness: proves assert_widths rejects a mismatched const | COMMENT |
| MEDIUM | .gitlab/ci/test.yml | 54 | # harness; keep cost visible as its own job. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | py/hashsigs_build.py | 264 | __all__ = [ | STRING |
| LOW | py/hashsigs_build.py | 318 | __all__ = [ | STRING |
| LOW | py/python/hashsigs/_errors.py | 16 | __all__ = ["HashSigsError", "ERROR_CODES"] | CODE |
| LOW | py/python/hashsigs/_api.py | 28 | __all__ = [ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 955 | ├── py/ # Python package scaffold (hashsigs) | CODE |