SBOM
The SBOM (software bill of materials) is an organization-wide, de-duplicated inventory of the dependencies across your repositories. It shows which packages the organization depends on, under which licenses, and which repositories a compromised package reaches.
Where to Find It
Open SBOM in the dashboard navigation. The active plan must include the SBOM feature; otherwise the navigation shows a lock. Check your current plan configuration for availability.
How It Is Built
Choose Run first scan to build the inventory, or Run scan to refresh it, and check completion before exporting. Export is unavailable until there is an inventory. The current account determines which repositories are eligible.
Codity builds the inventory from your manifests and lockfiles, reading them through your Git platform's API. Nothing is cloned. Each build covers up to 500 repositories.
Tabs
| Tab | What it shows |
|---|---|
| Components | Every component in the inventory, sortable by license risk |
| By repository | The inventory for each repository |
| Blast radius | Which repositories carry a given package |
| Zero days | Advisories that have no fix yet |
| Malware | Malicious-package advisories |
| Alerts | Vulnerabilities introduced or fixed between builds, with both open and closed alerts |
What Each Component Shows
- Whether it is a direct or transitive dependency
- Its dependency path
- Its license and license risk
- The OSV advisories that affect it
Exporting
For an organization-wide export, use Export format in the page header, select the format, then choose Export SBOM. Select CSV there to download a CSV report. Available formats include:
- CycloneDX 1.6
- SPDX 2.3
- CSV
For one repository, open By repository and use its export icon, labelled with the repository name, for example Export owner/repo's SBOM as CSV. This downloads that repository's components; it is separate from the header's organization-wide Export SBOM action.
Additional Resources
- Security Scanning: the dependency scan that runs on every pull request
- License Compliance Scanning: license risk and copyleft checks on a pull request
