Software bill of materials. Know what your software runs on.The applications you rely on are assembled from components someone else wrote. Every Pro rebuild gives you a CycloneDX list of them, so you can patch faster, recover sooner, and get through audits without the last-minute rush.
Software bill of materialsPayments Core · regenerated by run #12 · Oct 8, 2026CycloneDX| Component | Version | Type | License |
|---|---|---|---|
| openssl | 3.0.13 | Library | Apache-2.0 |
| log4j-core | 2.23.1 | Library | Apache-2.0 |
| express | 4.19.2 | Library | MIT |
| zlib | 1.3.1 | Library | Zlib |
| ledger-core | 4.2.0 | Private package | Proprietary |
| pdf-render-sdk | 9.1.0 | Licensed component | Commercial |
Showing 4 of 415 components.
European Union
Global standards
US
UK
Australia
Netherlands
{
"bomFormat": "CycloneDX",
"metadata": {
"component": { "type": "application", "name": "payments-core" }
},
"components": [
{ "type": "library", "name": "log4j-core", "version": "2.23.1",
"licenses": [{ "license": { "id": "Apache-2.0" } }] },
{ "type": "library", "name": "ledger-core", "version": "4.2.0",
"licenses": [{ "license": { "name": "Proprietary" } }] }
]
} Excerpt: 2 of 415 components.
Why our SBOM
If your SBOM tracks vulnerabilities in a regulated industry, it can't afford to feed you false information. On every Pro plan, Agentic Verification rebuilds your critical applications, so each SBOM matches what you're running right now.
SBOM · Run #8
412
components · first run
CycloneDXSBOM · Run #9
418
components · 6 added
CycloneDXSBOM · Run #10
421
components · 3 added, 7 updated
CycloneDXSBOM · Run #11
419
components · 2 removed, 4 updated
LatestFrom the rebuild: what the build actually pulled inEvery run: up to four times a yearCycloneDX: the standard format
What is an SBOM?
Think of an SBOM as your software's ingredients list, naming each library, package, and model it's built from, along with the version, type, and licence of every one.
Hand it to buyers to clear security reviews, and show regulators what you supply.
Spot vulnerabilities in what you rely on, and know what a recovery would take.
What you get
Name, version, type, and licence for each, drawn from the application as built.
Once models and datasets are listed, it qualifies as an AI bill of materials.
It records everything the build draws in, components missing from the repository included.
Export to the standard format read by most security and compliance tools, then send it to buyers, auditors, or authorities.
Every SBOM is kept in the vault alongside the software it covers, for as long as your framework demands.
Get flagged when a new vulnerability affects a component in your SBOM, between runs.
Why you need an SBOM
The CRA, and regulators like the FDA, ask for it outright. Others like DORA and NIS2 name it in different words. But they all agree you need a current component list to support continuity.
It must be machine-readable, held in your technical file, and provided whenever authorities request it. Applies from 11 December 2027.
It means an up-to-date record of your software assets and how they link together, and an SBOM is the most practical way to evidence it. Already in force.
How it works
Your Pro plan's Agentic Verification runs each produce a refreshed SBOM in CycloneDX format, keeping your compliance evidence up to date with no extra effort.
Link your repositories through 50+ integrations and upload anything stored elsewhere, so the vault has an up-to-date copy each day.
AI agents figure out how your software is built and rebuild it from our copy, using Codekeeper's own models, and once you add anything they flag as missing, the run finishes.
Check each component behind your application, with its version, type, and licence, along with models and datasets for AI applications.
| Component | Version | Type | Licence |
|---|---|---|---|
| openssl | 3.0.13 | Library | Apache-2.0 |
| log4j-core | 2.23.1 | Library | Apache-2.0 |
| express | 4.19.2 | Framework | MIT |
| zlib | 1.3.1 | Library | Zlib |
Each list sits in the vault next to the software it records, kept as long as your framework calls for.
Example values throughout.
Where your SBOM comes from
A list scanned from a repository can miss what the build actually pulls in. Yours comes from a real rebuild, by our agents or by our engineers.
Included in Pro plans
Escrow Pro, Resilience Pro, Continuity Pro, and Software Backup Pro include up to four runs a year, on supported technology stacks, each started whenever you choose, and every successful run produces a new SBOM. Releasing often? Add extra runs, or Component watch to flag new vulnerabilities in your components between runs.
Add-on to any plan
Working by hand from the deposit alone, our specialists rebuild your software, restore its data, deploy it, and test your chosen functions, then give you an SBOM of precisely what they restored.
Sample evidence pack
See what a run produces, using example values.
What's at stake
| Area | Without a current SBOM | With an SBOM from every successful run |
|---|---|---|
| Operations | ||
| Vulnerabilities | An exploited vulnerability becomes days of downtime as the team hunts for the library to fix. | Your component lists reveal the affected applications, so patching begins sooner. |
| Recovery | Recovery grinds to a halt, and the business stays down while someone hunts for missing components. | Your recovery team works from a list of everything the build requires. |
| End of life | An unsupported component breaks in production with nothing lined up to replace it. | Replacements are lined up well before support runs out. |
| Compliance | ||
| Audits | Findings from the audit end up as extra work on your team's roadmap. | The audit moves along, as your CycloneDX inventory is already on file. |
| Security reviews | The deal waits on a buyer's security review while you track down answers. | Drop the SBOM into the buyer's questionnaire, and the deal keeps moving. |
| EU market access | Without an SBOM, you risk losing EU market access and facing CRA fines of up to €15 million or 2.5% of worldwide annual turnover. | Your technical file contains the current SBOM the CRA demands for EU market access. |
| Authorities | Giving authorities inaccurate information brings separate fines of up to €5 million or 1% of worldwide annual turnover. | Each answer you give authorities is based on current information. |
Each release alters what your software contains. Speak to our software resilience specialists today about keeping your component records up to date.
Frequently asked questions
An SBOM contains an inventory of the components inside an application. The most accurate ones come from an actual build, as yours does, since a build picks up components that never sit in the repository.
Yes, an SBOM is required under the CRA, with manufacturers of products with digital elements obliged to produce one in a commonly used, machine-readable format covering at least top-level dependencies. Its vulnerability reporting duties have applied since 11 September 2026, and its main obligations apply from 11 December 2027. DORA and NIS2 don't name the SBOM, but they expect the inventory one provides.
The SBOM covers your application's top-level dependencies, the components it's built on directly, and, for AI applications, the models and datasets they run on, in CycloneDX, a standard format most security and compliance tools can read. You can export it to share with buyers, auditors, or authorities.
The SBOM is updated with every Agentic Verification run. Pro plans include up to four runs a year, on supported technology stacks, started whenever you choose. You can add more runs, or Component watch to flag new vulnerabilities in between. The Exit Exercise also produces an SBOM of the software as recovered.
No, your SBOM doesn't need to be published. The CRA only requires manufacturers to give their SBOM to market surveillance authorities when asked, and many vendors share theirs directly with buyers to get through security reviews.
Yes, escrow is still needed once you have an SBOM, because each does a different job. The SBOM lists the software's contents, while escrow holds everything required to recover it, and your SBOM comes from the very deposit your escrow protects.
