How to read an SBOM row?

An SBOM lists all components in your software, whether vulnerable or not. Each row helps you track risk, license, and provenance.

• Component Name: The package or library (e.g., openssl, lodash).
• Version: The specific version in use (e.g., 1.3.0).
• Type: Source (e.g., npm, Maven, pip), binary, or custom module.
• License: The license applied to the component (e.g., MIT, Apache-2.0, GPL).
• Supplier: Author or organization behind the component.
• Vulnerabilities: Linked CVEs or status like “none known”.
• Dependency Type: Whether the component is direct or transitive.
• PURL or SHA: Identifiers used to track the exact component version. This can replace component name and version)

Tip: Use SBOMs to audit both security (vulnerabilities) and legal (license) risk. Even non-vulnerable components may cause issues if their license is incompatible.