Security check

SBOM: a table of contents for your software

An SBOM lists every component in your software — the basis for answering 'are we affected?' when the next Log4Shell appears. We automatically generate an SBOM (CycloneDX + SPDX) per repo at scan time and run dependency audit on top.

Run a free domain scan All checks →
Relates to: NIS2 · art. 21 — supply chain ISO 27001 · A.8.8 US EO 14028 · SBOM

What we check

We automatically generate an SBOM in CycloneDX and SPDX format (via syft) from every repo at scan time, and run dependency audit (pip-audit / npm audit) incl. transitive dependencies on top. The component count and formats are shown in the report, so you can quickly answer whether a new CVE affects you.

Why it matters

When a critical vulnerability in a widely-used dependency is published, the first question is 'do we use it, and where?'. Without an SBOM that takes days. With one it takes minutes — and it's increasingly a supply-chain requirement.

How Security Guru tests it

Common mistakes

  • No SBOM at all → can't answer 'are we affected?'
  • SBOM covering only direct, not transitive dependencies
  • Static SBOM never updated on new releases
  • No link between SBOM and vulnerability data

What you get in the report

  • Dependency vulnerabilities per project (incl. transitive)
  • Components with known vulnerabilities flagged
  • Supply-chain risks ranked
  • Mapping to NIS2 supply chain / ISO A.8.8

FAQ

What's the difference from dependency scanning?

We do both: generate a full SBOM (to answer FUTURE vulnerabilities) AND run dependency audit (for today's known CVEs) on top.

What format?

CycloneDX and SPDX (JSON), generated per repo with syft. We also deliver vulnerability analysis of your dependencies on top.

Does it run self-hosted?

Yes — the dependency audit can run in your environment.

Want to know your status?

Run a free scan or order a full Security Assessment — prioritised, not noise.

Run a free domain scan