Automated Cryptographic Bill of Materials Generation for Quantum Readiness Assessment: A Multi-Language Static Analysis Approach

Quantum readiness requires organizations to inventory every cryptographic algorithm in their codebase -- a task that is infeasible to perform manually at scale. We present a multi-language cryptographic code scanner that performs static analysis across six programming languages (JavaScript/TypeScript, Python, Go, Java, Rust, C/C), identifies cryptographic API usage, classifies algorithms by quantum risk level, and generates a Cryptographic Bill of Materials (CBOM) in CycloneDX format. The scanner also detects embedded secrets (30+ patterns), analyzes binary files for cryptographic constants (AES S-box, SHA-256 initial values), and provides a CI/CD quality gate for enforcing post-quantum migration policies. We describe the pattern matching architecture, evaluate coverage across real-world codebases, and demonstrate integration with FTQC attack cost estimation for actionable quantum risk timelines.