SBOMApp

About

The SBOMApp tool brings comprehensive software supply chain security directly into VS Code. Developers can leverage natural language prompts to generate complete Software Bills of Materials (SPDX/CycloneDX) for their projects, including transitive dependencies. It provides deep insights by scanning for CVEs, detailing vulnerability information, and offering actionable fix versions and upgrade paths. Additionally, SBOMApp helps identify risky open-source licenses early, ensuring compliance. Designed for security-minded engineering organizations, it supports end-to-end visibility from local workspaces to builds and releases, all while guaranteeing absolute privacy by not storing user code or project data.

Key Features

• Generate comprehensive SBOMs (SPDX/CycloneDX) from local workspaces or Git repositories
• Ensures absolute data privacy by not storing user code, SBOMs, or project data
• Integrates with GitHub Copilot for natural language prompt-driven security tasks
• Analyze open-source licenses for compliance and risk assessment
• 0 GitHub stars
• Scan projects for security vulnerabilities, providing CVE details and remediation guidance

Use Cases

• Streamlining software supply chain security and compliance within the development workflow
• Ensuring license compliance for open-source components in regulated software
• Identifying and remediating vulnerabilities early in the software development lifecycle