# PQCrypta Discovery Agent — Windows Workstation preset
# For developer and office laptops/desktops: per-user crypto stores, SSH keys,
# browser NSS databases, mail clients, and developer/cloud tool credentials.
# The Windows Certificate Store (CryptoAPI) is ALWAYS scanned natively in
# addition to these paths.
#
# Usage: pqcrypta-discovery.exe --config windows-workstation.toml
#        Run elevated for the full security posture (BitLocker/TPM checks).
#
# TOML note: single-quoted 'literal strings' so backslashes need no escaping.
# <user> below: replace with the actual profile name, or leave scan_paths = []
# to use the built-in defaults which resolve the running user automatically.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# The built-in Windows defaults already resolve %USERPROFILE% for the running
# user and cover everything below plus server paths. Keeping this empty is
# recommended for workstations; the list below is here to show what a
# narrowed per-user scan looks like.
scan_paths = []
# scan_paths = [
#     # Per-user crypto stores
#     'C:\Users\<user>\AppData\Roaming\Microsoft\Crypto\',
#     'C:\Users\<user>\AppData\Local\Microsoft\Crypto\',
#     # SSH
#     'C:\Users\<user>\.ssh\',
#     # Browsers / mail (NSS databases)
#     'C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\',
#     'C:\Users\<user>\AppData\Roaming\Mozilla\Thunderbird\',
#     # Developer certs
#     'C:\Users\<user>\.aspnet\https\',
#     'C:\Users\<user>\AppData\Roaming\ASP.NET\Https\',
#     'C:\Users\<user>\Documents\IISExpress\config\',
#     # Container / cloud tooling
#     'C:\Users\<user>\.docker\',
#     'C:\Users\<user>\.kube\',
#     'C:\Users\<user>\.aws\',
#     'C:\Users\<user>\.azure\',
#     'C:\Users\<user>\.config\gcloud\',
#     # Package managers / build tools
#     'C:\Users\<user>\.m2\',
#     'C:\Users\<user>\.gradle\',
#     'C:\Users\<user>\.cargo\',
#     'C:\Users\<user>\.nuget\',
#     'C:\Users\<user>\.gem\',
# ]

excluded_paths = [
    'C:\Windows\WinSxS',
    'C:\Windows\Temp',
    'C:\$Recycle.Bin',
]

deep_scan = false

code_scan_paths = []
# Scan your local source checkouts for weak-crypto API calls (optional):
# code_scan_paths = ['C:\Users\<user>\source\repos']
