Azure DevOps

Overview

QCecuring integrates with Azure DevOps to scan repositories for cryptographic function calls, library dependencies, and pipeline configurations. Discovered crypto usage feeds into your CBOM for comprehensive visibility across your development lifecycle.

Key capabilities

• Scan Azure Repos for cryptographic API calls, hardcoded algorithms, and deprecated crypto usage.
• Analyze Azure Pipelines YAML for code signing steps, certificate references, and TLS configurations.
• Discover crypto libraries in project dependencies (NuGet, npm, Maven, etc.).
• Generate CBOM data from repository and pipeline scanning.

Typical use cases

• .NET and Microsoft-stack teams using Azure DevOps who need cryptographic visibility.
• Security teams scanning pipelines for code signing and crypto configuration compliance.
• Organizations building CBOM from development through deployment.

High-level integration flow

1. QCecuring connects to Azure DevOps via REST API with appropriate permissions.
2. Repositories are scanned for cryptographic function calls and library usage.
3. Pipeline definitions are analyzed for signing operations and crypto configurations.
4. Findings are normalized into CBOM format and fed into the centralized inventory.