Skip to main content

SBOM Export

Code Audit assessments can export a Software Bill of Materials as CycloneDX 1.5 or SPDX 2.3 JSON. Use this when a vendor questionnaire, customer security review, procurement process, or supply-chain tool asks for a machine-readable component inventory.

AISafe builds the SBOM from the same dependency inventory shown in the Dependency Risk panel. The exported file is downloaded from the assessment detail page. SBOM download is included with Code Audit. AISafe refuses the download if the bounded inventory read cannot finish, so a successful file is never a silently truncated first page of a large repository.

What the export contains​

  • package name, ecosystem, and version when AISafe can resolve one;
  • package URL coordinates where the ecosystem is known;
  • dependency scope, such as production or development;
  • license, homepage, and description when the manifest or lockfile provides them;
  • lockfile integrity hashes when the lockfile records them (npm package-lock.json, Cargo.lock, and Go go.sum), emitted as CycloneDX component hashes and SPDX checksums;
  • known vulnerability advisories for affected components, including severity, CVSS score and vector (CVSS v2, v3.x, and v4 are all scored), CWE identifiers, aliases such as CVE IDs, references, publication dates, and an upgrade recommendation when a safe fixed version is proven.

Formats​

FormatUse it for
CycloneDX 1.5Dependency-Track, OWASP/NTIA-style SBOM workflows, and modern supply-chain security tooling.
SPDX 2.3Procurement, legal, licensing, and ecosystem workflows that standardize on SPDX.

Coverage caveats​

The SBOM reflects source dependency metadata AISafe can extract from manifests and lockfiles. It is not a runtime attestation and should not be treated as a complete inventory of every component loaded in production.

Supported source ecosystems include JavaScript, Python, Go, Rust, Ruby, JVM, PHP/Composer, .NET/NuGet, SwiftPM, CocoaPods, Dart/pub, Elixir/Hex, Scala/SBT, Clojure, Conan, and vcpkg. Scala and Clojure dependencies use Maven package coordinates.

  • Lockfiles provide the strongest version confidence.
  • Manifest ranges may not identify the exact installed version.
  • Transitive coverage depends on ecosystem and lockfile availability.
  • Advisory records in the export mirror the Dependency Risk panel; the export does not include VEX exploitability statements (whether your application is actually affected), which remain the AI audit's job.
  • CocoaPods and vcpkg components remain in inventory and SBOM output, but advisory coverage for them is reported as unavailable rather than clean.