Software bill of materials. Know what your software runs on.The applications you depend on are pieced together from components you didn't write. Get a CycloneDX component list with every Pro rebuild, so you patch faster, recover sooner, and pass audits without a scramble.
Software bill of materialsPayments Core · regenerated by run #12 · Oct 8, 2026CycloneDX| Component | Version | Type | License |
|---|---|---|---|
| openssl | 3.0.13 | Library | Apache-2.0 |
| log4j-core | 2.23.1 | Library | Apache-2.0 |
| express | 4.19.2 | Framework | MIT |
| zlib | 1.3.1 | Library | Zlib |
| ledger-core | 4.2.0 | Private package | Proprietary |
| pdf-render-sdk | 9.1.0 | Licensed component | Commercial |
Showing 6 of 415 components.
European Union
Global standards
US
UK
Australia
Netherlands
{
"bomFormat": "CycloneDX",
"metadata": {
"component": { "type": "application", "name": "payments-core" }
},
"components": [
{ "type": "library", "name": "log4j-core", "version": "2.23.1",
"licenses": [{ "license": { "id": "Apache-2.0" } }] },
{ "type": "library", "name": "ledger-core", "version": "4.2.0",
"licenses": [{ "license": { "name": "Proprietary" } }] }
]
} Excerpt: 2 of 415 components.
Why our SBOM
If you rely on your SBOM to track vulnerabilities in a regulated industry, you can't afford for it to feed you false information. On every Pro plan, Agentic Verification rebuilds your critical applications, so each SBOM matches what you're running right now.
SBOM · Run #8
412
components · first run
CycloneDXSBOM · Run #9
418
components · 6 added
CycloneDXSBOM · Run #10
421
components · 3 added, 7 updated
CycloneDXSBOM · Run #11
419
components · 2 removed, 4 updated
LatestFrom the rebuild: what the build actually pulled inEvery run: up to four times a yearCycloneDX: the standard format
What is an SBOM?
An SBOM is the ingredients list for your software: every library, package, and model it's built from, with the version, type, and license of each.
Share it to clear buyers' security reviews and show regulators what you ship.
Use it to spot vulnerabilities in the software you depend on, and to know what a recovery needs.
What you get
Each one's name, version, type, and license, from the application as it was actually built.
With models and datasets listed, it meets the criteria of an AI bill of materials.
It captures what the build pulls in, including components that never sit in the repository.
Export it in the standard format most security and compliance tools read, for buyers, auditors, or authorities.
Each SBOM stays in the vault beside the software it describes, for as long as your framework requires.
Get flagged when a new vulnerability affects a component in your SBOM, between runs.
Why you need an SBOM
The CRA asks for it outright, as do regulators like the FDA. Other frameworks, like DORA and NIS2, don't name the SBOM, but they ask for the inventory it provides. They all agree you need a current component list to support continuity.
Machine-readable, kept in your technical file, and handed over when authorities ask. Applies from Dec 11, 2027.
A record of your software assets and how they connect, kept up to date. An SBOM is the most practical evidence for it. Applies now.
How it works
Each Agentic Verification run on your Pro plan gives you a regenerated SBOM in CycloneDX format, so your compliance evidence stays current without extra work.
Connect your repositories through 50+ integrations and upload anything kept outside them. Your vault holds a current copy every day.
AI agents work out how your software is built and rebuild it from the copy we hold, on Codekeeper's own models. Add anything they flag as missing, and the run completes.
Review every component your application was built on, including its version, type, and license, plus models and datasets for AI applications.
| Component | Version | Type | License |
|---|---|---|---|
| openssl | 3.0.13 | Library | Apache-2.0 |
| log4j-core | 2.23.1 | Library | Apache-2.0 |
| express | 4.19.2 | Framework | MIT |
| zlib | 1.3.1 | Library | Zlib |
Every list stays in the vault with the software it describes, for as long as your framework requires.
Screens show example values.
Where your SBOM comes from
A list scanned from a repository can miss what the build actually pulls in. Yours comes from a real rebuild, by our agents or by our engineers.
Included in Pro plans
Escrow Pro, Resilience Pro, Continuity Pro, and Software Backup Pro include up to four runs a year, on supported technology stacks, each started whenever you choose, and every successful run produces a new SBOM. Releasing often? Add extra runs, or Component Watch to flag new vulnerabilities in your components between runs.
Add-on to any plan
Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate. You get an SBOM of exactly what they brought back.
Sample evidence pack
It shows what a run produces, with example values.
What's at stake
| Area | Without a current SBOM | With an SBOM from every successful run |
|---|---|---|
| Operations | ||
| Vulnerabilities | An exploited vulnerability turns into days of downtime while the team searches for the library to fix it. | Affected applications show up in your component lists, so patching starts sooner. |
| Recovery | A recovery stalls, and the business stays offline while missing components are tracked down. | The recovery team works from a list of what the build needs. |
| End of life | An unsupported component fails in production with no replacement planned. | Replacements are planned long before support ends. |
| Compliance | ||
| Audits | An audit ends in findings, and fixing them lands on your team's roadmap. | Your inventory is already on file, in CycloneDX format. The audit moves on. |
| Security reviews | A buyer's security review holds up the deal while you chase answers. | The SBOM goes into the buyer's questionnaire, and the deal moves forward. |
| EU market access | A missing SBOM can cost you EU market access, and fines under the CRA of up to €15 million or 2.5% of worldwide annual revenue. | Your technical file holds the current SBOM the CRA requires for EU market access. |
| Authorities | Inaccurate information given to authorities carries separate fines of up to €5 million or 1% of worldwide annual revenue. | Every answer you give authorities draws on current information. |
Every release changes what's inside your software. Talk with our software resilience specialists today about keeping your component records current.
Frequently asked questions
An SBOM is an inventory of the components inside an application. The most accurate kind comes from a real build, which is how yours is produced, because it captures components that never sit in the repository.
Yes, the CRA requires an SBOM: manufacturers of products with digital elements must draw one up in a commonly used, machine-readable format, covering at least top-level dependencies. Its vulnerability reporting duties have applied since Sep 11, 2026, and its main obligations apply from Dec 11, 2027. DORA and NIS2 don't name the SBOM, but they ask for the inventory one provides.
The SBOM covers your application's top-level dependencies, meaning the components it's built on directly. For AI applications, it also covers the models and datasets they run on. It comes in CycloneDX, a standard format most security and compliance tools can read. You can export it to share with buyers, auditors, or authorities.
The SBOM is updated with every Agentic Verification run. Pro plans include up to four runs a year, on supported technology stacks, started whenever you choose. You can add more runs, or Component Watch to flag new vulnerabilities in between. The Exit Exercise also produces an SBOM of the software as recovered.
No, you don't have to make your SBOM public. Under the CRA, manufacturers hand their SBOM to market surveillance authorities on request, with no duty to publish it. Many vendors share theirs with buyers directly to clear security reviews.
Yes, you still need escrow if you have an SBOM. They do different jobs: the SBOM lists what the software contains, and escrow holds what it takes to recover it. Your SBOM is produced from the same deposit your escrow protects.
