Technical Guide

Evaluating Premium Post-Quantum Features in the Demo Sandbox

July 10, 2026

4 min read

Before purchasing a Standalone Auditor ($4,999/yr) or DevSecOps Enterprise ($24,999/yr+) licence, security officers and development leads often want to verify the two paid surfaces first: Tier A compliance evidence and Tier B integrations and fleet operations.

The CLI ships that evaluation path built in: ciphermap demo provisions an exact local sandbox where selected Tier A evidence runs without a licence. The same sandbox also demonstrates the Free remediation-proposal preview. Source publication remains disabled; arbitrary vault import and the Tier B integration and fleet surfaces remain licensed.

Provisioning the Sandbox & Evaluating Features

ciphermap demo creates ./ciphermap-demo-sandbox, a mock codebase (Go, Python, JavaScript, Rust, Java, and dependency manifests) full of legacy cryptography, and runs a baseline scan so you start from a graded report.

ciphermap demo
cd ciphermap-demo-sandbox

# 1. Evaluate Tier A: run a paid compliance profile (CNSA 2.0)
ciphermap scan . --target cnsa-2.0

# 2. Generate a CycloneDX 1.6 CBOM
ciphermap cbom . --format cyclonedx --output cbom.json

# 3. Generate an offline HTML compliance report
ciphermap report . --style technical --output auditor.html

# 4. Preview the supported remediation proposal (no source writes)
ciphermap fix . --dry-run

# 5. Inspect the documentation for any flagged rule
ciphermap rule PQC-GO-AST-002

How the Trial Boundary Works

Trial eligibility is based on exact embedded content, not guessed from the directory name. When ciphermap demo provisions the sandbox it writes an unauthoritative marker. A directory qualifies only while its supported source and configuration files match the demo bytes embedded in that CLI build and no extra supported source file exists — edit a file, add source, or copy only the marker into another tree, and it stops qualifying. Nothing inspects directory names or your git configuration, and nothing accuses you of anything: a directory either is the unmodified demo or it is not.

The engines are identical to the licensed product, but the entitlements remain distinct on your own repositories: Standalone Auditor Tier A unlocks profiles and audit evidence; DevSecOps Enterprise Tier B includes Tier A and adds integrations and fleet operations. Production source publication remains planned and unavailable in this release.