An SBOM is a formal, machine-readable inventory of software components, dependencies, libraries, and licenses that comprise a software build.
A Software Bill of Materials (SBOM) is an architectural inventory detailing all open-source libraries, direct dependencies, transitive packages, licenses, and compiler toolchains used to build a software application or container image. Driven by software supply chain security standards (Executive Order 14028, NIST SSDF), SBOMs enable rapid vulnerability triage when zero-day CVEs are discovered.
Lint Dockerfile dependencies using the Dockerfile Linter or validate GitHub Actions workflow dependencies in the GitHub Actions YAML Validator.
| Standard | Governing Body | File Formats | Primary Use Case |
|---|---|---|---|
| CycloneDX | OWASP | JSON, XML, Protobuf | Application security, runtime bills of materials, vulnerability tracking |
| SPDX | Linux Foundation (ISO/IEC 5962:2021) | JSON, YAML, Tag-Value | Open-source license compliance and intellectual property audits |
Free, browser-based utilities to test, generate, and inspect Software Bill of Materials (SBOM) payloads directly.
Lint, validate, format, and optimize Dockerfiles with Hadolint-compatible rules, security checks, and multi-stage analysis.
Validate, format and summarize GitHub Actions workflow YAML files against official schemas.
Analyze and visualize JavaScript bundle sizes with optimization suggestions.
