Orbit-cobalt-pqc

Attackers harvest encrypted data today to decrypt with quantum computers tomorrow. COBALT × Orbit maps every vulnerable crypto function using GitLab's Knowledge Graph + NIST migration paths.

Comment

Inspiration

Most security teams know post-quantum cryptography is coming. Few know where their codebase actually uses RSA, ECDSA, or Diffie-Hellman — the algorithms that quantum computers will break.

The Harvest Now, Decrypt Later (HNDL) threat makes this urgent. Nation-state adversaries are collecting encrypted traffic today, banking on decrypting it once quantum computers reach cryptographic relevance around 2030. NIST finalized the replacements in 2024 — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA). The standards exist. The migration tooling doesn't.

Generic SBOM scanners tell you what packages you have. They don't tell you which function on line 42 of auth/jwt_service.py is the one that will get your users' data decrypted in six years.

GitLab Orbit changes this.

What We Built

COBALT × Orbit is a quantum security scanner that uses the GitLab Orbit Knowledge Graph to locate every quantum-vulnerable cryptographic import and function definition in a codebase, then maps each finding to its NIST PQC replacement.

orbit-pqc scan .
# → 31 findings: 16 CRITICAL, 10 HIGH
# → RSA in auth/jwt_service.py:42 → ML-KEM-768 (FIPS 203)
# → ECDSA in crypto/sign.py:17 → ML-DSA-65 (FIPS 204)

It queries two Orbit tables directly via DuckDB SQL: gl_imported_symbol and gl_definition. The result is a per-function vulnerability map with CRITICAL/HIGH/MEDIUM risk levels and concrete NIST migration steps — exported as terminal output, JSON, or HTML.

Ships as a Python CLI, a GitLab Duo skill (skills/orbit-pqc/SKILL.md), and a .gitlab-ci.yml template that gates pipelines on quantum risk level.

Challenges

The schema wasn't documented. Orbit's actual table was gl_imported_symbol, not gl_import. Found by querying information_schema.tables live.

SQL comments broke the CLI. The orbit sql command parsed -- as an argument separator. Fixed by stripping comment lines before passing queries.

The skill format wasn't obvious. Skills live at skills/<name>/SKILL.md — file-based, no UI required.

What We Learned

Orbit's cross-file import graph gives context no static file scanner can match. The DuckDB interface makes it immediately useful for tooling — the barrier to building real security intelligence on Orbit is surprisingly low.

What's Next

  • Publish orbit-pqc to PyPI
  • Add Orbit Remote support for group-wide scans
  • GitLab Security Dashboard integration
  • Expand to all 11+ Orbit-supported languages

Built With

  • click
  • cobalt-sbom
  • duckdb
  • duo-agent-platform
  • gitlab
  • nist
  • orbit
  • pqc
  • python
  • rich
Share this project:

Updates