The impending arrival of cryptographically relevant quantum computers (CRQCs) threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIST standardising post-quantum cryptography (PQC) in 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), most codebases lack automated tooling to inventory classical cryptographic usage and prioritise migration based on quantum risk. We present Quantum-Safe Code Auditor, a quantum-aware static analysis framework that combines (i) regex-based detection of 15 classes of quantum-vulnerable primitives, (ii) LLM-assisted contextual enrichment to classify usage and severity, and (iii) risk scoring via a Variational Quantum Eigensolver (VQE) model implemented in Qiskit 2.x, incorporating qubit-cost estimates to prioritise findings. We evaluate the system across five open-source libraries -- python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, and Bouncy Castle Java -- covering 5,775 findings. On a stratified sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%. All code, data, and reproduction scripts are released as open-source.

翻译：密钥相关量子计算机（CRQCs）的即将到来威胁着现代软件的安全基础：Shor算法可破解RSA、ECDSA、ECDH和Diffie-Hellman，而Grover算法则降低了对称密码与哈希方案的等效安全强度。尽管NIST已于2024年标准化了后量子密码（PQC）体系（FIPS 203 ML-KEM、FIPS 204 ML-DSA、FIPS 205 SLH-DSA），但多数代码库仍缺乏自动化工具来清查经典密码使用情况并基于量子风险优先迁移。我们提出量子安全代码审计器（Quantum-Safe Code Auditor），这是一个量子感知的静态分析框架，包含三部分：(i) 基于正则表达式的15类量子脆弱原语检测，(ii) 大语言模型辅助的上下文增强分类以判定使用类型与严重程度，以及(iii) 通过Qiskit 2.x实现的变分量子特征求解器（VQE）模型进行风险评分，整合量子比特成本估算以优先排序发现。我们在五个开源库（ python-rsa、python-ecdsa、python-jose、node-jsonwebtoken和Bouncy Castle Java）上评估该系统，覆盖5,775个发现结果。在602个标注实例的分层样本上，我们实现了71.98%的精确率、100%的召回率和83.71%的F1分数。所有代码、数据和复现脚本均以开源形式发布。