# Sbomify

> Your Security Artifact Hub. From zero to SBOM hero. Generate, manage, and share SBOMs and compliance documents. Built for CRA compliance and seamless integration with your existing tools.

sbomify is a platform for generating, managing, and sharing Software Bill of Materials (SBOMs) and compliance documents. We help organizations achieve CRA compliance and seamlessly integrate with existing tools.

Key facts:

- Artifact types supported: SBOM (Software Bill of Materials), CBOM (Cryptography Bill of Materials), VEX (Vulnerability Exploitability eXchange), attestations, and compliance documents
- SBOM formats supported: CycloneDX 1.3 through 1.7 and SPDX 2.2, 2.3, and 3.0.1 (JSON), validated against official schemas
- VEX formats supported: CycloneDX VEX (JSON and XML), OpenVEX, and CSAF 2.0 VEX, with automatic format detection; VEX statements suppress findings in OSV and Dependency Track results
- Integrations: GitHub Actions (including OIDC trusted publishing for tokenless uploads), GitLab CI, Bitbucket Pipelines, Docker
- Onboarding: the interactive setup wizard (sbomify-action wizard, run via the Docker image) scans a repository, creates products and components, registers OIDC trusted publishing, and writes a ready-to-commit GitHub Actions workflow
- Analysis tools: Google OSV, Dependency Track, CISA KEV flagging, post-quantum cryptography (PQC) readiness assessment
- Enrichment: the open-source sbomify-action (https://github.com/sbomify/sbomify-action) enriches SBOMs from 12 data sources: native package registries (PyPI, pub.dev, crates.io, Conan Center, Debian Sources), aggregators (deps.dev, ecosyste.ms), fallback sources (PURL extraction, ClearlyDefined, Repology), and pre-computed license and lifecycle/EOL databases
- App: https://app.sbomify.com (support is handled via in-app support tickets)
- Source code: https://github.com/sbomify

## Content Topics

- SBOM generation, management, and sharing
- CycloneDX and SPDX formats
- CBOM (Cryptography Bill of Materials) and post-quantum cryptography (PQC) readiness
- VEX (Vulnerability Exploitability eXchange)
- Transparency Exchange API (TEA)
- SBOM signing and attestations
- Trust Centers for sharing security artifacts
- EU Cyber Resilience Act (CRA) and NIS2 compliance
- US Executive Order 14028, NTIA and CISA minimum elements
- NIST 800-53, NIST 800-171, FDA medical device, PCI DSS 4.0, BSI TR-03183
- Supply chain security and vulnerability management (OSV, KEV)
- Open source license compliance
- CI/CD pipeline integration

A full-content version of this file is available at https://sbomify.com/llms-full.txt

## Key Pages

- [About Us](https://sbomify.com/about/): We empower software vendors and software buyers to seamlessly manage security compliance and software supply chain transparency.
- [From Zero to SBOM Hero](https://sbomify.com/zero-to-hero/): Generate your first compliance-ready SBOM in under 5 minutes. A quick-start guide to SBOM generation, quality, and distribution.
- [Pricing](https://sbomify.com/pricing/): Simple, transparent pricing for teams of all sizes
- [Privacy Policy](https://sbomify.com/privacy/): Our commitment to protecting your privacy and personal data
- [SBOM Examples: Real CycloneDX and SPDX Files, Annotated](https://sbomify.com/sbom-examples/): Real SBOM examples in CycloneDX and SPDX, annotated field by field, with the same software shown in both formats. Includes live SBOMs you can download and check against the NTIA minimum elements.
- [SBOM Resources](https://sbomify.com/resources/): Discover the full SBOM life cycle: Generation, Distribution, and Analysis. Explore tools, benchmarks, and resources for creating, sharing, and utilizing Software Bills of Materials.
- [sbomify Action: Generate SBOMs in your CI/CD pipeline](https://sbomify.com/sbomify-action/): Generate Software Bills of Materials from your lockfiles, container images and source directories. 14 ecosystems, CycloneDX and SPDX, free and open source.
- [Share and Collaborate on SBOMs](https://sbomify.com/share-and-collaborate/): Centralize SBOM management and share software transparency artifacts with customers, auditors, and internal teams through sbomify's Trust Center and integrations.
- [Terms of Service](https://sbomify.com/terms/): Terms and conditions for using sbomify
- [What is an SBOM?](https://sbomify.com/what-is-sbom/): A Software Bill of Materials (SBOM) is a machine-readable inventory of every component, library, and dependency in your software. Learn what SBOMs are, why regulations require them, and how to get started.

## Features

- [A primer on the SBOM lifecycle for SBOM producers](https://sbomify.com/features/generate-collaborate-analyze/): Streamline your Software Bill of Materials (SBOM) workflow with our comprehensive guide. Learn about SBOM generation, collaboration, and analysis best practices, and discover how to automate distribution with sbomify.
- [Comprehensive SBOM Management for Complex Software Architectures](https://sbomify.com/features/sbom-hierarchy/): Understanding Software Bill of Materials (SBOM) Hierarchy: Learn how to manage complex software architectures by grouping components under products, simplifying SBOM management and sharing.
- [Integrations](https://sbomify.com/features/integrations/): Seamlessly integrate SBOM generation, analysis, and enrichment into your existing workflow.
- [The Growing Importance of SBOMs in Cybersecurity Compliance](https://sbomify.com/features/why-now/): Why SBOMs matter now: Executive Order 14028, the EU Cyber Resilience Act, PCI DSS 4.0, and the FDA are turning SBOMs into a baseline compliance requirement across industries.
- [Trust Center](https://sbomify.com/features/trust-center/): Build customer confidence with a dedicated trust center. Share SBOMs, compliance documents, and security artifacts publicly to demonstrate transparency.

## Compliance

- [BSI TR-03183-2: SBOM Requirements (v2.1.0)](https://sbomify.com/compliance/bsi-tr-03183/): Guide to the German Federal Office for Information Security (BSI) Technical Guideline TR-03183-2 v2.1.0, which defines SBOM format and content requirements aligned with the EU Cyber Resilience Act.
- [CISA Framing Software Component Transparency (3rd Edition)](https://sbomify.com/compliance/cisa-framing/): Guide to the CISA Framing document, the authoritative source for SBOM baseline attributes and CycloneDX/SPDX schema crosswalk.
- [CISA Minimum Elements for SBOM (2025 Draft)](https://sbomify.com/compliance/cisa-minimum-elements/): Guide to the CISA 2025 Minimum Elements for SBOM, the updated US guidance with new fields for component hash, license, and generation context.
- [CISA SBOM Sharing Lifecycle Report (2023)](https://sbomify.com/compliance/cisa-sharing-lifecycle/): Guide to the CISA SBOM Sharing Lifecycle Report, covering discovery, access, and transport patterns for SBOM distribution across supply chains.
- [CLE: Common Lifecycle Enumeration for SBOMs](https://sbomify.com/compliance/cle/): Guide to CLE (ECMA-428), the standard for machine-readable component lifecycle events including end-of-life, end-of-support, and provenance changes.
- [EU Cyber Resilience Act (CRA) SBOM Requirements](https://sbomify.com/compliance/eu-cra/): Complete guide to CRA SBOM requirements with BSI TR-03183-2 technical specifications. Covers format requirements, data fields, dependency depth, the 2026-2027 timeline, and compliance checklist.
- [EU NIS2 Directive SBOM Requirements](https://sbomify.com/compliance/eu-nis2/): Understanding NIS2 Directive cybersecurity requirements and how SBOMs support supply chain security, asset management, and incident response.
- [Executive Order 14028 SBOM Requirements](https://sbomify.com/compliance/eo-14028/): Understanding Executive Order 14028 and its SBOM requirements for US federal agencies and software vendors selling to the government.
- [FDA Medical Device SBOM Requirements (2025)](https://sbomify.com/compliance/fda-medical-device/): Guide to FDA cybersecurity guidance for medical devices, including SBOM requirements, support level, and end-of-support date expectations.
- [NIST 800-53 and SBOM Requirements: Security Controls for Software Supply Chains](https://sbomify.com/compliance/nist-800-53/): How NIST SP 800-53 Rev 5 security controls relate to SBOM requirements, covering the SA and SR control families for software supply chain risk management.
- [NIST SP 800-171 SBOM Requirements: Protecting CUI in Software Supply Chains](https://sbomify.com/compliance/nist-800-171/): How NIST SP 800-171 Rev 3 supply chain and component inventory controls relate to SBOM requirements for organizations handling Controlled Unclassified Information. Includes the CMMC phased rollout timeline through 2028.
- [NTIA Minimum Elements for SBOM (2021)](https://sbomify.com/compliance/ntia-minimum-elements/): Complete guide to the NTIA Minimum Elements for a Software Bill of Materials, the foundational US baseline for SBOM data fields, and where the baseline stands today: CISA's 2025 update, AI SBOM guidance, and OMB M-26-05.
- [PCI DSS 4.0 SBOM and Software Inventory Requirements](https://sbomify.com/compliance/pci-dss/): Guide to PCI DSS 4.0 software component inventory requirements, including Requirement 6.3.2 for bespoke software and third-party dependencies.
- [SBOM Schema Crosswalk: CycloneDX and SPDX Field Mappings](https://sbomify.com/compliance/schema-crosswalk/): Complete field mapping reference for CycloneDX 1.7, SPDX 2.3, and SPDX 3.0. Authoritative crosswalk for SBOM properties across formats.
- [Software Security Code of Practice (UK, May 2025)](https://sbomify.com/compliance/uk-software-security-code-of-practice/): Guide to the UK Software Security Code of Practice, a voluntary government code for secure software development, supply chain resilience, and customer communication.

## Guides

- [How to Version SBOMs - SemVer, CalVer, and Rolling Releases](https://sbomify.com/guides/how-to-version-sboms/): Learn best practices for versioning Software Bill of Materials. Guide covers Semantic Versioning, Calendar Versioning, rolling releases, and linking SBOMs to your release process.
- [SBOM Generation Guide for .NET - NuGet](https://sbomify.com/guides/dotnet/): Learn how to generate Software Bill of Materials for .NET and C# projects. Complete guide with packages.lock.json, PackageReference, and Microsoft SBOM Tool examples.
- [SBOM Generation Guide for C/C++ - Conan](https://sbomify.com/guides/cpp/): Learn how to generate Software Bill of Materials for C/C++ projects. Complete guide with conan.lock examples, vcpkg, and handling vendored dependencies.
- [SBOM Generation Guide for Dart and Flutter - pub](https://sbomify.com/guides/dart/): Learn how to generate Software Bill of Materials for Dart and Flutter projects. Complete guide with pubspec.lock examples and CycloneDX output.
- [SBOM Generation Guide for Docker and Containers](https://sbomify.com/guides/docker/): Learn how to generate Software Bill of Materials for Docker images and containers. Complete guide with multi-stage builds, distroless images, and attestation examples.
- [SBOM Generation Guide for Elixir - Mix](https://sbomify.com/guides/elixir/): Learn how to generate Software Bill of Materials for Elixir projects. Complete guide with mix.lock examples, Hex packages, and umbrella applications.
- [SBOM Generation Guide for Go - Go Modules](https://sbomify.com/guides/go/): Learn how to generate Software Bill of Materials for Go projects. Complete guide with go.mod and go.sum examples, CycloneDX and SPDX output.
- [SBOM Generation Guide for Java - Maven, Gradle](https://sbomify.com/guides/java/): Learn how to generate Software Bill of Materials for Java projects. Complete guide with pom.xml, build.gradle, and gradle.lockfile examples, CycloneDX and SPDX output.
- [SBOM Generation Guide for JavaScript - npm, yarn, pnpm, Bun](https://sbomify.com/guides/javascript/): Learn how to generate Software Bill of Materials for JavaScript and Node.js projects. Complete guide with package-lock.json, yarn.lock, pnpm-lock.yaml, and bun.lock examples.
- [SBOM Generation Guide for PHP - Composer](https://sbomify.com/guides/php/): Learn how to generate Software Bill of Materials for PHP projects. Complete guide with composer.lock examples, dev dependencies, and CycloneDX output.
- [SBOM Generation Guide for Python - UV, Poetry, Pipenv](https://sbomify.com/guides/python/): Learn how to generate Software Bill of Materials for Python projects. Complete guide with uv.lock, poetry.lock, and Pipfile.lock examples.
- [SBOM Generation Guide for Raspberry Pi - rpi-image-gen](https://sbomify.com/guides/raspberry-pi/): Learn how to generate Software Bill of Materials for Raspberry Pi custom images using rpi-image-gen. Complete guide with SPDX output and quality analysis.
- [SBOM Generation Guide for Ruby - Bundler](https://sbomify.com/guides/ruby/): Learn how to generate Software Bill of Materials for Ruby projects. Complete guide with Gemfile.lock examples, platform-specific gems, and CycloneDX output.
- [SBOM Generation Guide for Rust - Cargo](https://sbomify.com/guides/rust/): Learn how to generate Software Bill of Materials for Rust projects. Complete guide with Cargo.lock examples, workspace dependencies, and CycloneDX output.
- [SBOM Generation Guide for Scala - sbt](https://sbomify.com/guides/scala/): Learn how to generate Software Bill of Materials for Scala projects. Complete guide with build.sbt examples, cross-compilation, and dependency management.
- [SBOM Generation Guide for Swift - Swift Package Manager](https://sbomify.com/guides/swift/): Learn how to generate Software Bill of Materials for Swift projects. Complete guide with Package.resolved examples, Xcode integration, and CycloneDX output.
- [SBOM Generation Guide for Terraform - Infrastructure as Code](https://sbomify.com/guides/terraform/): Learn how to generate Software Bill of Materials for Terraform projects. Complete guide with .terraform.lock.hcl examples, provider dependencies, and security considerations.
- [SBOM Generation Guide for Yocto - Embedded Linux](https://sbomify.com/guides/yocto/): Learn how to generate Software Bill of Materials for Yocto-based embedded Linux projects. Complete guide covering SPDX 2.2 and SPDX 3.0.1 with bitbake integration.
- [SBOM Generation in CI/CD Pipelines - GitHub Actions, GitLab CI, Bitbucket](https://sbomify.com/guides/ci-cd/): Learn how to automate SBOM generation in CI/CD pipelines. Complete guide with GitHub Actions, GitLab CI, Bitbucket Pipelines, and attestation examples.

## FAQ

- [What is an SBOM (Software Bill of Materials)?](https://sbomify.com/faq/what-is-an-sbom/): Learn what a Software Bill of Materials (SBOM) is, why it matters for supply chain security, and how it lists every component in your software.
- [Why do I need an SBOM?](https://sbomify.com/faq/why-do-i-need-an-sbom/): Discover why your organization needs a Software Bill of Materials for vulnerability management, regulatory compliance, and customer trust.
- [What SBOM formats does sbomify support?](https://sbomify.com/faq/what-sbom-formats-does-sbomify-support/): sbomify supports CycloneDX 1.3-1.7 and SPDX 2.2, 2.3, and 3.0.1 SBOM formats in JSON, with automatic validation and schema compliance checking.
- [Can I convert between CycloneDX and SPDX?](https://sbomify.com/faq/can-i-convert-between-cyclonedx-and-spdx/): Why converting between CycloneDX and SPDX SBOM formats is problematic and what to do instead.
- [Can I combine multiple SBOMs into one?](https://sbomify.com/faq/can-i-combine-multiple-sboms-into-one/): Why merging multiple SBOMs into a single file loses context, and how to link them together instead using sbomify's hierarchy.
- [Is sbomify free?](https://sbomify.com/faq/is-sbomify-free/): Learn about sbomify's pricing tiers including the free Community plan for open-source projects, the Business plan for teams, and Enterprise options.
- [What is the EU Cyber Resilience Act (CRA)?](https://sbomify.com/faq/what-is-the-eu-cyber-resilience-act/): Understand the EU Cyber Resilience Act, its SBOM requirements, timeline, and how sbomify helps you achieve CRA compliance.
- [Are SBOMs required for Secure by Design?](https://sbomify.com/faq/are-sboms-required-for-secure-by-design/): Learn why SBOMs are a non-optional requirement for Secure by Design and Secure by Default practices, backed by CISA guidance, the EU CRA, and US Executive Orders.
- [How do I sign an SBOM?](https://sbomify.com/faq/how-do-i-sign-an-sbom/): Learn how to cryptographically sign your SBOMs using GitHub Attestations, Sigstore, and in-toto so that consumers can verify authenticity without trusting any intermediary.
- [How do I use CRA compliance in sbomify?](https://sbomify.com/faq/how-do-i-use-cra-compliance/): Practical walkthrough of the sbomify CRA Compliance Wizard: scope screening, the five wizard steps, what ends up in the export bundle, and how to sign it.
- [How do I generate an SBOM?](https://sbomify.com/faq/how-do-i-generate-an-sbom/): Step-by-step guide to generating your first SBOM using sbomify-action, open-source tools, and CI/CD integration.
- [How do I use the sbomify setup wizard?](https://sbomify.com/faq/how-do-i-use-the-sbomify-setup-wizard/): The interactive setup wizard (sbomify-action wizard) scans your repository, creates your products and components, sets up OIDC trusted publishing, and writes a ready-to-commit GitHub Actions workflow.
- [How do I set up OIDC trusted publishing?](https://sbomify.com/faq/how-do-i-set-up-oidc-trusted-publishing/): OIDC trusted publishing lets GitHub Actions upload SBOMs to sbomify without any long-lived token secret, using short-lived OpenID Connect tokens instead.
- [How do I enable vulnerability scanning in sbomify?](https://sbomify.com/faq/how-do-i-enable-vulnerability-scanning/): Guide to enabling vulnerability scanning in sbomify using Google OSV and Dependency Track, including plan availability and scan frequency.
- [What VEX formats does sbomify support?](https://sbomify.com/faq/what-vex-formats-does-sbomify-support/): sbomify natively ingests VEX documents in CycloneDX VEX (JSON and XML), OpenVEX, and CSAF 2.0 VEX formats, with automatic format detection.
- [How do I use VEX with sbomify?](https://sbomify.com/faq/how-do-i-use-vex/): Learn how Vulnerability Exploitability eXchange (VEX) lets you communicate which vulnerabilities actually affect your product, and how to upload, triage, and distribute VEX documents through sbomify.
- [What is a CBOM and how does sbomify support it?](https://sbomify.com/faq/what-is-a-cbom/): A Cryptography Bill of Materials (CBOM) inventories the cryptographic assets in your software. sbomify auto-detects CBOMs, builds a crypto inventory, and assesses post-quantum readiness.
- [How does sbomify count vulnerabilities?](https://sbomify.com/faq/how-does-sbomify-count-vulnerabilities/): sbomify counts vulnerabilities against your current posture - the latest artifact per component and format - not by summing findings across every SBOM version you have ever uploaded.
- [What is a Trust Center?](https://sbomify.com/faq/what-is-a-trust-center/): Learn what a Trust Center is, how it helps you share security artifacts transparently, and how sbomify makes it easy to create one.
- [How do I set up a Trust Center in sbomify?](https://sbomify.com/faq/how-do-i-set-up-a-trust-center/): Step-by-step guide to enabling and configuring a Trust Center in sbomify, including custom domain setup, security.txt, NDA upload, and component visibility.
- [How do I enable the Transparency Exchange API (TEA) in sbomify?](https://sbomify.com/faq/how-do-i-enable-tea-in-sbomify/): Step-by-step guide to enabling the Transparency Exchange API (TEA) in sbomify for automated SBOM discovery and distribution.
- [How do products work in sbomify?](https://sbomify.com/faq/how-do-products-work-in-sbomify/): Understand sbomify's hierarchy of components, products, and releases for organizing and managing SBOMs across your software portfolio.
- [How do I upload compliance documents?](https://sbomify.com/faq/how-do-i-upload-compliance-documents/): Step-by-step guide to uploading compliance documents like SOC 2, ISO 27001, and CE certificates in sbomify by creating a Document component.
- [How do I create a software release in sbomify?](https://sbomify.com/faq/how-do-i-create-a-software-release/): Step-by-step guide to creating a product release in sbomify by linking existing component SBOMs to a versioned release.
- [How do I delete a workspace?](https://sbomify.com/faq/how-do-i-delete-a-workspace/): Step-by-step guide to deleting a workspace in sbomify, including what happens to your data.
- [How do I delete my account?](https://sbomify.com/faq/how-do-i-delete-my-account/): Step-by-step guide to deleting your account in sbomify, including what happens to your data.
- [How do I achieve NTIA/CISA minimum elements compliance?](https://sbomify.com/faq/how-do-i-achieve-ntia-cisa-compliance/): Guide to meeting NTIA and CISA SBOM minimum elements requirements using sbomify-action's augmentation feature and sbomify's central profile management.
- [How do I attach signatures and provenance to SBOMs?](https://sbomify.com/faq/how-do-i-use-signature-files/): Walk through uploading detached cryptographic signatures (cosign-bundle, PGP, PKCS#7) and SLSA in-toto provenance attestations to your SBOMs in sbomify, where the Signed and Provenance badges appear, and how the SBOM Verification plugin validates both.

## Case Studies

- [Atsign Case Study: Working towards NTIA compliance](https://sbomify.com/case-studies/atsign/): Atsign provides a platform for secure and private communication, and its NoPorts product is used for zero-trust infrastructure access. This is how sbomify helped them improve the quality of their SBOMs.
- [Screenly Case Study: Simplifying SBOM Management with sbomify](https://sbomify.com/case-studies/screenly/): Screenly is a secure digital signage platform and this is how sbomify helped secure their SBOM supply chain.

## Blog

- [Announcing sbomify v26.7.1: The One That Says "Not Affected"](https://sbomify.com/2026/07/30/announcing-sbomify-v26-7-1-the-one-that-says-not-affected/): sbomify v26.7.1 ships end-to-end VEX support across CycloneDX, OpenVEX, and CSAF, with in-product triage, Dependency-Track sync, and scheduled drift detection. CBOM ingestion now covers every lineage, the Trust Center exposes VEX and CBOM per release, and vulnerability counts finally reflect your current posture.
- [ENISA's New Healthcare Procurement Guidelines Ask for SBOMs Without Saying the Word](https://sbomify.com/2026/07/23/enisa-healthcare-procurement-guidelines/): ENISA's July 2026 procurement guidelines for hospitals and healthcare providers require supply chain transparency, component listings, and vulnerability management. Here is how SBOMs satisfy them.
- [Announcing sbomify v26.7.0: The One That Gets Quantum-Ready](https://sbomify.com/2026/07/07/announcing-sbomify-v26-7-0-the-one-that-gets-quantum-ready/): sbomify v26.7.0 adds Cryptography BOM (CBOM) support with NIST-grounded post-quantum readiness assessment, per-token API rate limiting with audit logging, a rebuilt authorization layer, and a broad security hardening pass.
- [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass.
- [SPDX 3.0 in Yocto: What Changed and Why It Matters](https://sbomify.com/2026/05/19/yocto-spdx-3-0-overview/): Part 3 of the Yocto SBOM series. SPDX 3.0 support arrived in Styhead (Yocto 5.1) with single-document JSON-LD output, first-class Build elements, native VEX support, and richer build provenance features.
- [Announcing sbomify v26.2.0: The One That Signs the DoC](https://sbomify.com/2026/05/13/announcing-sbomify-v26-2-0-the-one-that-signs-the-doc/): sbomify v26.2.0 completes the EU CRA workflow with a signed Declaration of Conformity, adds Component Lifecycle Events, SBOM signatures and provenance, and full CycloneDX 1.7 / SPDX 3.0.1 support.
- [A Deep Dive into Yocto's SPDX 2.2 Pipeline](https://sbomify.com/2026/05/12/yocto-spdx-2-2-pipeline/): Part 2 of the Yocto SBOM series. How the create-spdx-2.2.bbclass produces SPDX documents during a Yocto build, the three core BitBake tasks involved, and the document-linking model that ties everything together.
- [How Yocto Generates SBOMs Behind the Scenes: A Deep Dive into SPDX 2.2 and SPDX 3.0](https://sbomify.com/2026/05/05/yocto-sbom-deep-dive-introduction/): Yocto generates SBOMs during the build itself, not after. Part 1 of a 5-part series on how the Yocto Project builds SPDX 2.2 and SPDX 3.0 SBOMs from BitBake metadata, with first-class VEX support.
- [Announcing sbomify v26.1.0: The One Where We Switch to CalVer](https://sbomify.com/2026/04/02/announcing-sbomify-v26-1-0-the-one-where-we-switch-to-calver/): sbomify v26.1.0 introduces the CRA Compliance Wizard, switches to CalVer versioning, adds Trust Center subdomain routing, and brings full TEA v0.4.0 compatibility.
- [Trivy Compromise: How We Are Hardening sbomify-action](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/): Aqua Security's Trivy was compromised twice in two weeks. Here is how we audited and hardened sbomify-action in response, and why we are moving to short-lived OIDC tokens.
- [SBOM Adoption on PyPI Is at 1.58%. We Can Do Better.](https://sbomify.com/2026/03/12/pypi-sbom-analysis/): We scanned 15,021 of the most popular Python packages for PEP 770 SBOMs. Only 1.58% include one, and every single SBOM is CycloneDX. Here are the full results.
- [PEP 770: SBOMs Are Now a First-Class Citizen in Python Packages](https://sbomify.com/2026/03/05/pep-770-sboms-in-python-packages/): Python's PEP 770 standardizes shipping SBOMs inside packages via .dist-info/sboms/. Here's what it means and how we adopted it in two projects with minimal effort.
- [Announcing sbomify-action v0.14: The One With Yocto](https://sbomify.com/2026/03/02/announcing-sbomify-action-v0-14-the-one-with-yocto/): sbomify-action v0.14 adds a dedicated Yocto/OpenEmbedded batch processing command, full SPDX 3.0.1 pipeline support, pipdeptree integration for Python transitive dependencies, caching for faster CI runs, and renames from github-action to sbomify-action.
- [Why We're Bullish on TEA, And Why You Should Be Too](https://sbomify.com/2026/03/01/why-were-bullish-on-tea/): The Transparency Exchange API (TEA) is the missing standard for automated SBOM discovery and exchange. Here's what it is, why it matters, and why sbomify is all in.
- [Announcing sbomify v0.27: The One with TEA](https://sbomify.com/2026/02/24/announcing-sbomify-v0-27-the-one-with-tea/): sbomify v0.27 adds full Transparency Exchange API (TEA) support, SPDX 3.0 compatibility, scoped access tokens, and improved account management.
- [Announcing sbomify v0.26: The One Where Bootstrap Moved Out](https://sbomify.com/2026/02/16/announcing-sbomify-v0-26-the-one-where-bootstrap-moved-out/): sbomify v0.26 delivers a faster, more accessible UI, real-time dashboard updates, BSI TR-03183-2 compliance, and GDPR self-service account deletion.
- [The Role of SBOMs in Cybersecurity: From Visibility to Vulnerability Response](https://sbomify.com/2026/02/08/sbom-cybersecurity-role/): Learn how SBOMs strengthen cybersecurity through component visibility, vulnerability management, incident response, and compliance with EO 14028, EU CRA, and more.
- [What Is CVSS? Understanding Vulnerability Severity Scoring](https://sbomify.com/2026/02/05/what-is-cvss-vulnerability-scoring/): Learn what CVSS is, how vulnerability severity scores are calculated, the differences between CVSS v3.1 and v4.0, and how to use CVSS with KEV and SBOMs for prioritization.
- [Announcing sbomify-action v0.13: The One Where We Go to FOSDEM](https://sbomify.com/2026/02/04/announcing-sbomify-action-v0-13-the-one-where-we-go-to-fosdem/): sbomify-action v0.13 brings hash enrichment from lockfiles, an interactive configuration wizard, Conan Center integration for C/C++, and improved NTIA compliance with supplier fields and PURL generation from VCS URLs.
- [SBOM Scanning: How to Detect Vulnerabilities in Your Software Components](https://sbomify.com/2026/02/01/sbom-scanning-vulnerability-detection/): Learn how SBOM scanning works, which tools to use, how to set up continuous vulnerability monitoring, and how to act on scan results effectively.
- [What Is a Dependency in Software? A Beginner's Guide](https://sbomify.com/2026/01/29/what-is-a-dependency-in-software/): Learn what software dependencies are, the difference between direct and transitive dependencies, how dependency trees work, and how SBOMs document them.
- [SBOM Generation Tools Compared: Syft, Trivy, cdxgen, and More](https://sbomify.com/2026/01/26/sbom-generation-tools-comparison/): Compare the leading SBOM generation tools – Syft, Trivy, cdxgen, Microsoft SBOM Tool, and CycloneDX CLI – covering format support, ecosystems, and CI/CD integration.
- [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges.
- [The MIT License: A Complete Guide for Developers](https://sbomify.com/2026/01/22/mit-license-guide/): Understand the MIT License – what it permits, what it requires, how it compares to BSD and Apache 2.0, and how SBOMs help track MIT license compliance.
- [Announcing sbomify-action v0.11: The One Where They Go to PyPI](https://sbomify.com/2026/01/20/announcing-sbomify-action-v0-11-the-one-where-they-go-to-pypi/): sbomify-action v0.11 transforms from a CI-only tool into a fully-fledged CLI available on PyPI. Major additions include audit trails for compliance, SPDX format support, a pre-computed license database covering 28 Linux distro versions, and native Rust SBOM generation.
- [SBOM Management: How to Organize, Track, and Act on Your SBOMs](https://sbomify.com/2026/01/18/sbom-management-best-practices/): Learn how to manage SBOMs across the full lifecycle – from generation and storage to vulnerability monitoring, versioning, and distribution to consumers.
- [SBOM Formats Compared: CycloneDX vs SPDX](https://sbomify.com/2026/01/15/sbom-formats-cyclonedx-vs-spdx/): A practical comparison of CycloneDX and SPDX SBOM formats covering history, governance, field differences, tooling, compliance preferences, and when to use which.
- [Announcing sbomify v0.24: The One with All the Plugins](https://sbomify.com/2026/01/14/announcing-sbomify-v0-24-the-one-with-all-the-plugins/): sbomify v0.24 introduces a powerful plugin-based assessment framework supporting security, license, compliance, and attestation plugins. Ships with NTIA, CISA, CRA, and FDA compliance plugins out of the box.
- [Software Composition Analysis (SCA): What It Is and How SBOMs Fit In](https://sbomify.com/2026/01/11/software-composition-analysis-sca/): Learn what software composition analysis is, how SCA tools work, how SCA compares to SAST and DAST, and how SBOMs complement SCA for full supply chain visibility.
- [FDA Medical Device SBOM Requirements: What the New Cybersecurity Guidance Means for Manufacturers](https://sbomify.com/2026/01/09/fda-medical-device-sbom-requirements/): Breakdown of the FDA's June 2025 guidance on medical device cybersecurity, explaining SBOM requirements, premarket submission expectations, and compliance strategies.
- [Apache License 2.0: What It Is, How It Works, and What It Means for Your Software](https://sbomify.com/2026/01/07/apache-license-2-guide/): Understand the Apache License 2.0, its patent grant, attribution requirements, NOTICE file, compatibility with GPL, and how SBOMs track compliance.
- [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://sbomify.com/2026/01/06/cra-explained-cyber-resilience-act-for-device-manufacturers/): Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers.
- [Container Security: Best Practices for Securing Docker and Kubernetes](https://sbomify.com/2026/01/03/container-security-best-practices/): A comprehensive guide to container security covering image scanning, runtime protection, network policies, and how SBOMs provide component visibility.
- [What Is a KEV? Understanding CISA's Known Exploited Vulnerabilities Catalog](https://sbomify.com/2025/12/30/what-is-kev-cisa-known-exploited-vulnerabilities/): What is a KEV? CISA's Known Exploited Vulnerabilities catalog lists CVEs under active attack. Learn how KEV differs from CVE and CVSS, and how SBOMs automate KEV monitoring.
- [Software Supply Chain Management: Risks, Best Practices, and SBOM Integration](https://sbomify.com/2025/12/26/software-supply-chain-management/): Learn what software supply chain management is, how attacks like Log4Shell and XZ Utils exploit it, and how SBOMs provide visibility and risk reduction.
- [The GPL License: A Comprehensive Guide to the GNU General Public License](https://sbomify.com/2025/12/22/gpl-license-guide/): Understand the GPL license, including GPL v2 vs v3, copyleft obligations, LGPL, AGPL, commercial use, and how SBOMs track GPL compliance.
- [Major Updates: sbomify v0.21 and Action Module v0.8 & v0.9](https://sbomify.com/2025/12/19/major-updates-sbomify-v0-21-and-action-modules/): Triple release: sbomify v0.21 with vulnerability trends dashboard, plus GitHub Action v0.8 and v0.9 featuring modular generation plugins and 8 enrichment data sources.
- [CVE Vulnerabilities Explained: What They Are and Why They Matter](https://sbomify.com/2025/12/18/cve-vulnerability-explained/): Learn what CVE vulnerabilities are, how the CVE system works, the role of MITRE and NVD, and how SBOMs enable rapid vulnerability response.
- [Software Development Life Cycle (SDLC): A Complete Guide](https://sbomify.com/2025/12/15/software-development-life-cycle-sdlc-sbom-integration/): Learn what the Software Development Life Cycle (SDLC) is, its phases and models, and how SBOMs integrate into each stage for security and compliance.
- [Announcing sbomify v0.20: Custom Domains & Streamlined Onboarding](https://sbomify.com/2025/12/12/announcing-sbomify-0-20/): sbomify v0.20 release featuring custom domain support for Trust Centers, redesigned onboarding wizard, team invitation improvements, and security hardening.
- [Announcing GitHub Action 0.7.0 and sbomify 0.19](https://sbomify.com/2025/12/05/announcing-github-action-0-7-0-and-sbomify-0-19/): Major releases: GitHub Action 0.7.0 with ecosyste.ms enrichment and SPDX support, plus sbomify 0.19 with full Django+HTMX migration, custom domains, and CycloneDX 1.7.
- [Using Conan for C SBOMs](https://sbomify.com/2025/09/04/conan/): How to use the Conan package manager to generate SBOMs for C and C++ projects, addressing the lack of native package management in these languages.
- [CISA's Minimum Elements now in Draft](https://sbomify.com/2025/08/23/cisa-minimum-elements/): Analysis of CISA's 2025 draft SBOM Minimum Elements update, adding required hash, license, and tool provenance fields to succeed the 2021 NTIA guidance.
- [Big Update to sbomify](https://sbomify.com/2025/07/04/big-update-to-sbomify/): sbomify v0.15 introduces document support alongside SBOMs, improved public pages, and product-level SBOM aggregation – evolving into a complete compliance hub.
- [Unpacking Raspberry Pi's Built‑In SBOM Magic](https://sbomify.com/2025/04/17/unpacking-raspberry-pi-s-built-in-sbom-magic/): How Raspberry Pi's rpi-image-gen tool generates SPDX SBOMs out of the box, achieving a 7.8/10 quality score with sbomqs for embedded image builds.
- [Mastering SBOM Generation with Yocto](https://sbomify.com/2025/02/21/mastering-sbom-generation-with-yocto/): Deep dive into Yocto's built-in SPDX 2.2 SBOM generation, analyzing output quality with sbomqs and integrating with sbomify for SBOM lifecycle management.
- [Chris Swan Joins sbomify Advisory Board](https://sbomify.com/2025/02/21/chris-swan-joins-sbomify/): Chris Swan, Engineer at Atsign and former CTO at UBS, joins sbomify's advisory board bringing DevOps, open source, and cybersecurity expertise.
- [sbomify Goes Open Source: A New Chapter in SBOM Management](https://sbomify.com/2025/01/31/announcing-sbomify-open-sourced/): sbomify is now open source under Apache 2.0 plus Common Clause. Learn about our hierarchical SBOM approach, CycloneDX support, and Project Koala integration plans.
- [How SBOMs Can Help You Achieve PCI DSS 4.0 Compliance](https://sbomify.com/2025/01/07/how-sboms-can-help-you-achieve-pci-dss-4-compliance/): Discover how Software Bill of Materials (SBOMs) help online gambling and e-commerce businesses achieve PCI DSS 4.0 compliance through better vulnerability management and audit trails.
- [The C conundrum - generating SBOMs when there's no lockfile](https://sbomify.com/2024/11/18/c-conundrum/): Exploring the challenge of generating SBOMs for C/C++ projects without native package managers, reviewing cmake-sbom, Conan, cve-bin-tool, and CISA working group efforts.
- [sbomify GitHub Action v0.3.0: Now Faster and Compatible with GitLab!](https://sbomify.com/2024/11/12/gitlab-support/): sbomify GitHub Action v0.3.0 release adds GitLab CI/CD support, 50% faster build times, and bug fixes for Docker image SBOM generation.
- [GitHub Action module with Attestation](https://sbomify.com/2024/10/31/github-action-update-and-attestation/): New features in sbomify's GitHub Action including Dart lockfile support, Docker image SBOMs, NTIA enrichment, and SLSA build provenance attestation.
- [Big update to our GitHub Action](https://sbomify.com/2024/10/04/github-action-update/): Major overhaul of sbomify GitHub Action transforming it from a simple upload tool to a complete SBOM Swiss Army knife with generation, augmentation, and enrichment.
- [How to generate an SBOM from a Docker container](https://sbomify.com/2024/09/20/how-to-generate-an-sbom-from-a-container/): Guide to generating SBOMs from Docker container images using Syft, Trivy, and Docker Desktop, including limitations and best practices for separating container from application SBOMs.
- [Introducing sbomify: Revolutionizing SBOM Management](https://sbomify.com/2024/08/29/launching-sbomify/): Announcing the launch of sbomify, a platform for automated SBOM management and sharing that integrates with CI/CD pipelines to ensure stakeholders always have the latest SBOMs.
- [Exploring the Future of Software Security: Join Us at BSides Bristol](https://sbomify.com/2024/08/26/bsides-bristol/): sbomify presents 'Navigating the SBOM Landscape: Formats, Relevance, and Tooling in 2024' at BSides Bristol, covering SPDX, CycloneDX, and current SBOM tooling.
- [Announcing sbomify's GitHub Actions Module: Seamlessly Share SBOMs in Your CI/CD Pipeline](https://sbomify.com/2024/08/21/introducing-github-action-module/): Introducing sbomify's GitHub Actions module for automated SBOM generation in your CI/CD pipeline. Available on GitHub Marketplace for seamless integration.
- [Comparing SBOM Formats: Focus on Component Types in CycloneDX vs. SPDX](https://sbomify.com/2024/08/20/sbom-component-types/): A detailed comparison of CycloneDX and SPDX SBOM formats, analyzing their support for applications, libraries, containers, operating systems, and SaaS components.
- [What Is SLSA? Understanding Supply Chain Levels for Software Artifacts](https://sbomify.com/2024/08/17/what-is-slsa/): What is SLSA? The OpenSSF framework for software supply chain security defines three build levels for provenance and integrity. Learn how SLSA works, how it builds on in-toto, and how to adopt it with GitHub Actions.
- [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity.
- [What Is Sigstore? Keyless Signing for the Software Supply Chain](https://sbomify.com/2024/08/12/what-is-sigstore/): What is Sigstore? The CNCF-graduated project makes cryptographic signing effortless with keyless signing via Fulcio, transparency logging via Rekor, and container signing via Cosign. Learn how Sigstore secures artifacts, SBOMs, and supply chains.
- [How to Generate SBOMs for Python Packages with `pipdeptree` and `cyclonedx-py`](https://sbomify.com/2024/07/30/generate-sboms-for-python-packages-with-pipdeptree-and-cyclonedx-py/): Tutorial on generating CycloneDX SBOMs for Python projects using pipdeptree and cyclonedx-py, including transitive dependencies and best practices for pinning with hashes.
- [What Is Lock File Drift? A Hidden Risk in Dependency Management](https://sbomify.com/2024/07/30/what-is-lock-file-drift/): What is lock file drift? When your dependency manifest and lock file fall out of sync, builds become unreproducible and SBOMs become inaccurate. Learn how to detect, prevent, and fix lock file drift across npm, Python, Go, Rust, and more.
- [Embracing Cybersecurity with CISA's 'Secure by Design' Initiative](https://sbomify.com/2024/07/24/embracing-cybersecurity-with-cisas-secure-by-design-initiative/): Overview of CISA's Secure by Design guide, its three core principles for software manufacturers, and practical steps for implementing security from the start.
- [What's New in SPDX 3: Enhanced Referencing Capabilities](https://sbomify.com/2024/07/22/whats-new-in-spdx-3-enhanced-referencing-capabilities/): SPDX 3 draft introduces nested references, cross-document references, and improved relationship types to match CycloneDX capabilities for complex SBOM management.
- [Understanding the EU Cyber Resilience Act: SBOM Requirements and Compliance](https://sbomify.com/2024/07/10/understanding-the-eu-cyber-resilience-act-the-role-of-sboms-in-enhancing-cybersecurity/): What does the EU Cyber Resilience Act require? The CRA mandates SBOMs, vulnerability handling, and security updates for all products with digital elements sold in the EU. Learn the timeline, product categories, and how to prepare.
- [The Role of SBOMs in an OBOM: Ensuring Compliance and Security in Smart Thermometer Development](https://sbomify.com/2024/07/09/the-role-of-sboms-in-an-obom-ensuring-compliance-and-security-in-smart-thermometer-development/): How to integrate SBOMs into Operations Bill of Materials (OBOM) for IoT devices, using a smart thermometer example with Python backend, Docker, and Rust firmware.
- [Enhancing Dependency Management with GitHub's Dependency Graph: An Analysis](https://sbomify.com/2024/06/24/enhancing-dependency-management-with-githubs-dependency-graph-an-analysis/): Research analysis revealing inaccuracies in GitHub's dependency graph for Java and Python projects, with implications for Dependabot and SBOM generators.
- [Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)](https://sbomify.com/2024/06/11/framing-software-component-transparency-establishing-a-common-software-bill-of-materials-sbom/): Summary of NTIA's SBOM Framing document 2nd edition highlighting transparency, interoperability standards, and what to expect in the upcoming 3rd edition.
- [Get the latest SBOMs from the top 15 most popular images on Docker Hub](https://sbomify.com/2024/06/04/get-the-latest-sboms-from-the-top-15-most-popular-images-on-docker-hub/): Automated nightly SBOM generation for Docker Hub's top 15 images including nginx, postgres, redis, and node using Syft in GitHub Actions CI/CD pipeline.
- [Comprehensive Guide to Generating and Understanding SBOMs with Docker and Django-CMS](https://sbomify.com/2024/05/27/comprehensive-guide-to-generating-and-understanding-sboms-with-docker-and-django-cms/): Practical walkthrough of generating SBOMs from Docker containers and Python projects using Django-CMS as an example, covering cyclonedx-python, docker sbom, and transitive dependencies.
- [Call for Views on the Code of Practice for Software Vendors: Ensuring Security and Resilience](https://sbomify.com/2024/05/26/call-for-views-on-the-code-of-practice-for-software-vendors-ensuring-security-and-resilience/): UK government launches consultation on voluntary Code of Practice for Software Vendors to enhance security and resilience of digital products sold to businesses.
- [Enhancing SBOM Sharing: A Look at Current Practices and the Role of sbomify](https://sbomify.com/2024/05/13/enhancing-sbom-sharing-a-look-at-current-practices-and-the-role-of-sbomify/): Analysis of CISA's SBOM Sharing Primer examining current SBOM sharing methods from email to automated tooling, and how sbomify simplifies the distribution process.
- [Understanding ISO 42001 and the Integration of SBOMs for Enhanced Operational Resilience](https://sbomify.com/2024/05/02/understanding-iso-42001-and-the-integration-of-sboms-for-enhanced-operational-resilience/): How to integrate SBOMs with ISO 42001 operational resilience management systems for better risk assessment, incident response, and compliance.
- [Harnessing ISO 27001 and SBOMs for Enhanced Information Security Management](https://sbomify.com/2024/04/29/harnessing-iso-27001-and-sboms-for-enhanced-information-security-management/): How to integrate SBOMs into ISO 27001 information security management systems for better risk assessment, compliance auditing, and vendor management.
- [Exploring the New SPDX 3.0: A Game Changer for SBOMs](https://sbomify.com/2024/04/28/exploring-the-new-spdx-3-0-a-game-changer-for-sboms/): Overview of SPDX 3.0 improvements including enhanced compatibility, improved accuracy, streamlined automation, and broader software package support for SBOM generation.
- [What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem](https://sbomify.com/2024/04/25/openssf-and-openssf-scorecards-bolstering-open-source-security/): What is OpenSSF? The Open Source Security Foundation coordinates industry-wide efforts to secure open source software. Learn about OpenSSF Scorecards, how to run them, what they measure, and how they connect to SBOMs, SLSA, and supply chain security.
- [How SBOMs Streamline SOC 2 Compliance: Insights for the Agile Enterprise](https://sbomify.com/2024/04/23/how-sboms-streamline-soc-2-compliance-insights-for-the-agile-enterprise/): Guide on using SBOMs to simplify SOC 2 Type I and Type II compliance through improved transparency, proactive risk management, and streamlined audits.
- [What really happened to XZ?](https://sbomify.com/2024/04/13/what-really-happened-to-xz/): Analysis of the XZ backdoor discovery in Linux distributions, exploring how this supply chain attack worked and the implications for open-source security.
- [Elevate Your Cybersecurity with Our Leading SBOM Management Solution](https://sbomify.com/2024/04/12/elevate-your-cybersecurity-with-our-leading-sbom-management-solution/): How sbomify's SBOM management platform helps organizations comply with Executive Order 14028 through comprehensive visibility, vulnerability management, and streamlined reporting.
- [NIST Cybersecurity Framework (CSF) 2.0: What It Means for Software Supply Chain Security](https://sbomify.com/2024/04/11/introducing-the-nist-cybersecurity-framework-csf-2-0/): A practical guide to NIST CSF 2.0, its six core functions including the new GOVERN function, and how SBOMs support CSF 2.0 implementation for supply chain risk management and vulnerability monitoring.
- [What Is a CBOM? The Cryptography Bill of Materials Explained](https://sbomify.com/2024/04/10/future-proofing-cybersecurity-with-the-cryptography-bill-of-materials-cbom/): What is a CBOM? The Cryptography Bill of Materials inventories every cryptographic asset in your software – algorithms, keys, certificates, and protocols. Learn how CBOMs prepare organizations for the post-quantum transition.
- [How to create an SBOM](https://sbomify.com/2024/04/07/how-to-create-an-sbom/): Step-by-step guide to generating SBOMs using Docker CLI and GitHub tools including the command line interface, Dependency Graph, and REST API.
- [Elevating M&A Due Diligence with SBOMs: A Guide for Corporate Strategists](https://sbomify.com/2024/04/07/elevating-ma-due-diligence-with-sboms-a-guide-for-corporate-strategists/): How SBOMs accelerate M&A due diligence compared to traditional source code analysis with Black Duck, offering faster evaluation, IP protection, and streamlined compliance.
- [Elevating M&A Due Diligence with sbomify's SBOM Management](https://sbomify.com/2024/04/03/elevating-ma-due-diligence-with-sbomifys-sbom-management/): How sbomify streamlines M&A due diligence by providing comprehensive software asset evaluation, vulnerability assessment, and license compliance checking.
- [Streamlining Open Source License Compliance in M&A: Unveiling the sbomify Advantage](https://sbomify.com/2024/04/03/streamlining-open-source-license-compliance-in-ma-unveiling-the-sbomify-advantage/): Learn how sbomify simplifies open source license compliance during M&A due diligence by automating SBOM analysis to identify GPLv3 and other non-permissive licenses.
- [The Time is Now: Embracing SBOMs in an Era of Enhanced Cybersecurity Standards](https://sbomify.com/2024/04/03/the-time-is-now-embracing-sboms-in-an-era-of-enhanced-cybersecurity-standards/): Why 2024-2026 is the critical window for SBOM adoption. From EO 14028 and the EU Cyber Resilience Act to PCI DSS 4.0 and FDA guidance, regulatory requirements are converging – and the tooling is ready.
- [SBOM Management for Software Vendors: A Complete Guide to sbomify](https://sbomify.com/2024/04/03/sbomify-a-paradigm-shift-for-software-vendors-in-sbom-management/): How software vendors use sbomify to generate compliance-ready SBOMs in CI/CD, enrich them with 11 data sources, attest with GitHub Actions, and share via Trust Center – all from an open source GitHub Action.
- [Navigating the Landscape of Open Source Licenses](https://sbomify.com/2024/04/03/navigating-the-landscape-of-open-source-licenses/): Comprehensive guide to open source licenses including MIT, Apache 2.0, GPL, BSD, MPL, and more. Learn the differences between permissive and copyleft licenses and how SBOMs help with license compliance.
- [Enhancing SBOM Management for Software Buyers with sbomify](https://sbomify.com/2024/04/03/enhancing-sbom-management-for-buyers-with-sbomify/): How sbomify helps CTOs and CISOs manage SBOMs from software vendors – with Trust Center access, vulnerability monitoring, license compliance, and SBOM hierarchy for complex supply chains.
- [Demystifying SBOMs: The Backbone of Modern Software Security](https://sbomify.com/2024/04/03/demystifying-sboms-the-backbone-of-modern-software-security/): What is an SBOM? A Software Bill of Materials is a machine-readable inventory of every component in your software. Learn about SBOM formats (SPDX, CycloneDX), generation tools, vulnerability management, and compliance requirements.

## Content Policy

All content on this site is freely accessible for indexing and training purposes. We encourage accurate representation of our platform and educational content.

## Contact

- Website: https://sbomify.com/
- App: https://app.sbomify.com
- GitHub: https://github.com/sbomify
- X/Twitter: https://x.com/sbomify
- LinkedIn: https://www.linkedin.com/company/sbomify/