No cipher archaeology, no forked TLS library, no six-month spike. Point your edge at Secuur, set mode = "hybrid", ship. X25519 + ML-KEM-768 on every handshake, tracked to NIST automatically.
# the one line secuur.tls.mode = "hybrid" # that's it. defaults: kex = x25519 + ml-kem-768 sig = ecdsa-p256 + ml-dsa-65 track = nist-fips-203/204/205
The same engine behind the website, as a JSON API. Gate deploys on it, wire it into CI, fail the build if a service ships classical-only.
# grade a host $ curl https://api.secuur.me/v2/scan \ -H "Authorization: Bearer $KEY" \ -d '{ "host": "api.acme.com", "deep": true }'
{
"host": "api.acme.com",
"grade": "D",
"exposed": true,
"kex": "ecdhe-p256",
"hndl": "vulnerable",
"fix": "enable ml-kem-768"
}
secuur scan --fail-under B — and quantum drift never merges.The client and server each derive a classical and a post-quantum shared secret, then KDF them together. Break one, the session still holds. Break both — nobody can.
Every Secuur endpoint runs hybrid PQC — including the Scan API itself. Run curl api.secuur.me/v2/scan against us and you'll get an A. We won't ask you to run anything we don't.
Self-serve from $49/mo. No sales call, no migration committee — just hybrid PQC on your next deploy.