sbom-generator

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

A suite of tools to assist with reviewing Open Source Software dependencies.

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles

Codenotary Community Attestation Service (CAS) for notarization and authentication of digital artifacts

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects

Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects

Creates CycloneDX Software Bill of Materials (SBOM) from Go modules

Examples and proof-of-concept for Software Bill of Materials (SBOM) code & data

Lockheed Martin developed utility to generate CycloneDX SBOMs for Linux distributions

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects

The SCANOSS Audit Workbench graphical user interface to scan and audit your source code.

A software bill of materials (SBoM) generator for Swift packages

A GitHub Action that creates a SBOM from your application so you can meet compliance and security requirements. Add this to your dev, staging and prod steps and SecureStack will make sure that what you've just deployed is secure and meets your requirements, and has the SBOM to show it!