SBOM · License (Components and Licenses)
If you do not know what is inside, you cannot know what is at risk. This analysis generates a component inventory (SBOM) for your source code and evaluates the license risk of each component. For the Source Code service, it is generated automatically from dependencies.
Image / uploaded SBOM
SBOMs of container images are covered in Image SBOM · Hardening, and SBOM files you have already built are covered in SBOM upload.
SBOM (component inventory)
- Provides a full list of which open source is included and at what version.
- Can be exported in standard formats (CycloneDX / SPDX).
- Supported ecosystems: npm · PyPI · RubyGems · Maven / Gradle · Go · Cargo · Composer · NuGet · pub (Dart) · Swift · OS packages · container images
License risk
Licenses are shown sorted in order of highest risk.
- Copyleft (for example, GPL, AGPL) : distribution terms are strict, so care is needed for commercial distribution.
- Unknown : components whose license could not be identified.
- Permissive (for example, MIT, Apache-2.0) : generally low risk.
On the SBOM screen you can review the license of each component along with whether it is permissive or requires caution.
Continuous inventory monitoring
The SBOM inventory is continuously monitored, so when a new CVE is published it is detected and an alert is raised without a rescan. (See SCA.)